From ab6f09074619b10e9aee2d8e0b9661ce01dd4fd9 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Thu, 29 Oct 2026 15:58:01 +0100 Subject: [PATCH 01/94] instructions: the web goes through the Chrome the person already uses; work inside pages is Browser MCP's, or name it once Gustav 29/10: computer-mcp should always use the person's normal, signed-in Chrome for the web, and hand in-page work to browser-mcp when it is in the session. This server does not see inside pages (its own instructions say so), so the in-page part is browser-mcp's; without it, the agent names Browser MCP once with its install line and never installs. test/laering.mjs 1c-1f pin the text; each check mutation-proven. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 8 ++++++++ mcp-server/index.js | 12 ++++++++++++ test/laering.mjs | 5 +++++ 3 files changed, 25 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 19c072e1..565d8a1c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,14 @@ Dates are the day the version was tagged. Everything here was measured before it was written down; where a claim has a test, the test is named. +## 0.4.1 (in progress) + +**The web goes through the Chrome you already use.** The instructions the server sends with it now say that a step +on the web uses the Chrome the person normally uses and is signed in to - not Safari, a new profile or another +browser. This server does not see inside pages, so when Browser MCP's tools are in the session, the work inside +the page is theirs; when they are not and the task is mostly in web pages, the agent says once that Browser MCP +does that, with its install line, and never installs it itself. Test: `test/laering.mjs` 1c-1f. + ## 0.4.0 (in progress) **A stop lets go of the mouse button and starts nothing new.** A drag holds the diff --git a/mcp-server/index.js b/mcp-server/index.js index 6ace6e82..3cf0a884 100644 --- a/mcp-server/index.js +++ b/mcp-server/index.js @@ -264,6 +264,18 @@ or [cut: ...], the answer is PART of the tree - narrow it with \`computer_find\` rather than trusting what came back. It does not see inside web pages; that is what a browser tool is for. +The web: when a step needs a web page, use the Chrome the person normally uses - +the profile whose windows are open, signed in to their accounts - not Safari, a +new profile or another browser, unless they ask for one. \`computer_windows\` +with app "Google Chrome" shows its windows. This server does not see inside +pages, so if Browser MCP's tools (browser_*) are in this session, let them do +the work inside the page - they work in that same Chrome - and keep this server +for what is outside it: the file picker, an OS dialog, another app. If they are +not here and the task is mostly inside web pages, tell the person once that +Browser MCP does that (https://browsermcp.dev, by the same maker: a Chrome +extension plus \`claude mcp add --scope user browser-mcp -- npx @agent360/browser-mcp@latest\`). +Do not install it yourself. + Everything is written to an append-only audit log with a rolling chain.`; const server = new Server( diff --git a/test/laering.mjs b/test/laering.mjs index e18a8240..fdced284 100644 --- a/test/laering.mjs +++ b/test/laering.mjs @@ -35,6 +35,11 @@ try { check('1 værktøjet findes', vaerktoejer.some(t => t.name === 'computer_learning')); const vejl = (await rpc('initialize', { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'x', version: '1' } })).result?.instructions || ''; check('1b vejledningen peger på det, når et trin intet gjorde', /computer_learning/.test(vejl)); + // 29/10 (Gustav): nettet går gennem den Chrome personen bruger og er logget ind i, og arbejdet inde i siden er Browser MCP's. + check('1c nettet går gennem personens egen, indloggede Chrome', /use the Chrome the person normally uses/.test(vejl) && /signed in to their accounts - not Safari/.test(vejl)); + check('1d arbejdet inde i siden gives til Browser MCP, når den er her', /if Browser MCP's tools \(browser_\*\) are in this session, let them do/.test(vejl)); + check('1e mangler Browser MCP, får personen den rigtige installation', /claude mcp add --scope user browser-mcp -- npx @agent360\/browser-mcp@latest/.test(vejl) && /a Chrome\s+extension plus/.test(vejl)); + check('1f agenten installerer aldrig selv', /Do not install it yourself\./.test(vejl)); const r = await kald('computer_learning', { kind: 'workaround', app: 'net.whatsapp.WhatsApp', tool: 'computer_set_value', From 995f07cf5c8ddf32991b205e33a3fe18bb88fdc5 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Thu, 29 Oct 2026 16:50:45 +0100 Subject: [PATCH 02/94] instructions: ask when the Chrome profile is unclear; browser_* works in its extension's profile (P183) Opus P183: GODKENDT MED RETTELSER - C1 applied verbatim, checks 1g/1h added (each proven red when its phrase is removed). Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 8 +++++--- mcp-server/index.js | 17 ++++++++++------- test/laering.mjs | 2 ++ 3 files changed, 17 insertions(+), 10 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 565d8a1c..fc56f74e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,9 +7,11 @@ was written down; where a claim has a test, the test is named. **The web goes through the Chrome you already use.** The instructions the server sends with it now say that a step on the web uses the Chrome the person normally uses and is signed in to - not Safari, a new profile or another -browser. This server does not see inside pages, so when Browser MCP's tools are in the session, the work inside -the page is theirs; when they are not and the task is mostly in web pages, the agent says once that Browser MCP -does that, with its install line, and never installs it itself. Test: `test/laering.mjs` 1c-1f. +browser - and that the agent asks the person when it cannot tell which profile a task belongs to. This server does +not see inside pages, so when Browser MCP's tools are in the session, the work inside the page is theirs, in the +profile where their extension is installed; when they are not and the task is mostly in web pages, the agent says +once that Browser MCP does that, with its install line, and never installs it itself. Test: `test/laering.mjs` +1c-1h. ## 0.4.0 (in progress) diff --git a/mcp-server/index.js b/mcp-server/index.js index 3cf0a884..71ebd1ca 100644 --- a/mcp-server/index.js +++ b/mcp-server/index.js @@ -267,13 +267,16 @@ what a browser tool is for. The web: when a step needs a web page, use the Chrome the person normally uses - the profile whose windows are open, signed in to their accounts - not Safari, a new profile or another browser, unless they ask for one. \`computer_windows\` -with app "Google Chrome" shows its windows. This server does not see inside -pages, so if Browser MCP's tools (browser_*) are in this session, let them do -the work inside the page - they work in that same Chrome - and keep this server -for what is outside it: the file picker, an OS dialog, another app. If they are -not here and the task is mostly inside web pages, tell the person once that -Browser MCP does that (https://browsermcp.dev, by the same maker: a Chrome -extension plus \`claude mcp add --scope user browser-mcp -- npx @agent360/browser-mcp@latest\`). +with app "Google Chrome" shows its windows. If you cannot tell which profile the +task belongs to - windows from several are open, or the titles do not say - ask +the person once with \`computer_ask_user\` - never pick one yourself. This server +does not see inside pages, so if Browser MCP's tools (browser_*) are in this session, let them do +the work inside the page - they work in the Chrome profile where their extension +is installed, which browser_about names, so check it is that same profile - and +keep this server for what is outside it: the file picker, an OS dialog, another +app. If they are not here and the task is mostly inside web pages, tell the +person once that Browser MCP does that (https://browsermcp.dev, by the same +maker: a Chrome extension plus \`claude mcp add --scope user browser-mcp -- npx @agent360/browser-mcp@latest\`). Do not install it yourself. Everything is written to an append-only audit log with a rolling chain.`; diff --git a/test/laering.mjs b/test/laering.mjs index fdced284..cd826c42 100644 --- a/test/laering.mjs +++ b/test/laering.mjs @@ -40,6 +40,8 @@ try { check('1d arbejdet inde i siden gives til Browser MCP, når den er her', /if Browser MCP's tools \(browser_\*\) are in this session, let them do/.test(vejl)); check('1e mangler Browser MCP, får personen den rigtige installation', /claude mcp add --scope user browser-mcp -- npx @agent360\/browser-mcp@latest/.test(vejl) && /a Chrome\s+extension plus/.test(vejl)); check('1f agenten installerer aldrig selv', /Do not install it yourself\./.test(vejl)); + check('1g flere profiler: agenten spørger og vælger ikke selv', /cannot tell which profile[\s\S]{0,160}computer_ask_user/.test(vejl) && /never pick one yourself/.test(vejl)); + check('1h browser_* arbejder i udvidelsens profil - tjek at det er den', /profile where their extension\s+is installed, which browser_about names/.test(vejl)); const r = await kald('computer_learning', { kind: 'workaround', app: 'net.whatsapp.WhatsApp', tool: 'computer_set_value', From 9828cf2cbc20252f3edcacba6ed11e9f7186c802 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Fri, 30 Oct 2026 11:52:07 +0100 Subject: [PATCH 03/94] fix: 0.4.1 - baggrundsboksen lover ikke at kodeordsprogrammer spoerger (C19), stille-vej giver scroll et punkt, LICENSE med i pakken MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - policy.js:623: i baggrund afvises adgangskode-programmer (maaIkke) - boksen sagde «still always ask». :632 (forgrund) er sand. ikon-godkend D2 fanger loeftet; mutationsbevist (gammel tekst -> 1 DUMPET, ny -> 60 OK). - stille-vej.mjs:293: hjaelperen kraever et punkt sammen med --app siden ed09c85 (main.swift:1020) - midten af forreste vindue, som index.js:1325-1328. Gjorde Fremmed Mac roed paa 0.4. - mcp-server/LICENSE + "LICENSE" i files: MIT-teksten fulgte hverken npm- eller MCPB-pakken. Co-Authored-By: Claude Opus 5.5 --- mcp-server/LICENSE | 21 +++++++++++++++++++++ mcp-server/policy.js | 3 ++- test/ikon-godkend.mjs | 1 + test/stille-vej.mjs | 6 +++++- 4 files changed, 29 insertions(+), 2 deletions(-) create mode 100644 mcp-server/LICENSE diff --git a/mcp-server/LICENSE b/mcp-server/LICENSE new file mode 100644 index 00000000..d5cab333 --- /dev/null +++ b/mcp-server/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2026 Agent360 Group ApS + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/mcp-server/policy.js b/mcp-server/policy.js index 788b3572..86efef63 100644 --- a/mcp-server/policy.js +++ b/mcp-server/policy.js @@ -620,7 +620,8 @@ export async function decide({ tier, targetBundleId, describe, alwaysAsk = false if (sessionGranted) return { allow: true, reason: 'this session already has consent', asked: false }; if (baggrund()) { - const v = await viaIkonet({ omfang: 'If you allow it, the agent may click and type for the rest of this session. Password apps still always ask.' }); + // 0.4.1 (C19, panel R1 24/10): i baggrund afvises adgangskode-programmer (maaIkke) - de spoerger ikke. :631 (forgrund) er sand. + const v = await viaIkonet({ omfang: 'If you allow it, the agent may click and type for the rest of this session. Password apps stay refused while it works in the background.' }); if (v.allow) sessionGranted = true; return v; } diff --git a/test/ikon-godkend.mjs b/test/ikon-godkend.mjs index f7bab639..75b1f266 100644 --- a/test/ikon-godkend.mjs +++ b/test/ikon-godkend.mjs @@ -419,6 +419,7 @@ const d2a = await D2.rpc('tools/call', { name: 'computer_type', arguments: { app const d2b = await D2.rpc('tools/call', { name: 'computer_type', arguments: { app: 'Finder', text: 'def' } }); check('D2 ask: foerste skrivning godkendt fra ikonet', !d2a.result.isError, d2a.result.content[0].text.slice(0, 70)); check('D2 ...ikonet fik omfanget «resten af sessionen»', /rest of this session/.test(ikonD.modtaget[foerD2]?.scope || ''), ikonD.modtaget[foerD2]?.scope); +check('D2 ...og omfanget lover ikke at adgangskode-programmer spoerger (i baggrund afvises de, policy.js maaIkke)', !/password (apps?|managers?)[^.]*\b(always\s+)?asks?\b/i.test(ikonD.modtaget[foerD2]?.scope || '') && /refused/i.test(ikonD.modtaget[foerD2]?.scope || ''), ikonD.modtaget[foerD2]?.scope); check('D2 ...og anden skrivning spurgte ikke igen', !d2b.result.isError && ikonD.modtaget.length === foerD2 + 1, `${ikonD.modtaget.length - foerD2} spoergsmaal`); D2.srv.kill(); ikonD.srv.close(); process.env.CMCP_MODE = 'allow'; diff --git a/test/stille-vej.mjs b/test/stille-vej.mjs index 696e1b2d..d4ba477c 100644 --- a/test/stille-vej.mjs +++ b/test/stille-vej.mjs @@ -290,7 +290,11 @@ try { if (!FREMMED_MASKINE) { sprang('leverer vi i det program mennesket SIDDER i, indroemmer den det', ROER_GRUND); } else if (forrestNavn) { - const eget = koer('scroll', '--dx', '0', '--dy', '0', '--app', forrestNavn); + // 0.4.1: siden ed09c85 (10/10) kraever hjaelperen et punkt sammen med --app (main.swift:1020) - samme punkt som + // serveren selv giver (index.js:1325-1328): midten af programmets forreste vindue. + const vf = (koer('windows', '--app', forrestNavn).windows || [])[0]?.frame; + const eget = vf ? koer('scroll', '--dx', '0', '--dy', '0', '--app', forrestNavn, '--x', String(vf.x + vf.w / 2), '--y', String(vf.y + vf.h / 2)) + : { took_screen: null, error: `${forrestNavn} har intet vindue at rulle i` }; check('leverer vi i det program mennesket SIDDER i, indroemmer den det', eget.took_screen === true, `${forrestNavn}: ${JSON.stringify(eget)}`); } else { From d411a01e7fb906cea615d3012e8beb10f7c0e9f8 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Fri, 30 Oct 2026 11:52:08 +0100 Subject: [PATCH 04/94] deps: SDK-gulv ^1.32.1 + laasefilen paa rettede underpakker (npm audit 5 -> 0) SDK'en selv uaendret (1.32.1). zod 4.6.7, body-parser 2.4.0, @hono/node-server 2.1.5, fast-uri 3.1.9, qs 6.17.1 - samme versioner som en frisk npx-installation faar i dag, saa proeverne maaler det brugerne koerer (som f808150). Gulvet holder 1.30.x (1 hoej advarsel) ude af en cachet installation. "LICENSE" i files, saa MCPB-bundtet faar den. Co-Authored-By: Claude Opus 5.5 --- mcp-server/package-lock.json | 40 ++++++++++++++++++------------------ mcp-server/package.json | 3 ++- 2 files changed, 22 insertions(+), 21 deletions(-) diff --git a/mcp-server/package-lock.json b/mcp-server/package-lock.json index d96e39ec..c00b0792 100644 --- a/mcp-server/package-lock.json +++ b/mcp-server/package-lock.json @@ -9,7 +9,7 @@ "version": "0.4.0", "license": "MIT", "dependencies": { - "@modelcontextprotocol/sdk": "^1.0.0" + "@modelcontextprotocol/sdk": "^1.32.1" }, "bin": { "computer-mcp": "bin/cli.js" @@ -19,15 +19,15 @@ } }, "node_modules/@hono/node-server": { - "version": "2.1.1", - "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-2.1.1.tgz", - "integrity": "sha512-ELuehkj5VCBdgEw9zs+ivkKwyzzUCSQuE96YmiPvn1ECBoZCczbFXJLeEGMTYjphP6gydh4pHMqEYPVMYUVgQg==", + "version": "2.1.5", + "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-2.1.5.tgz", + "integrity": "sha512-MgP/I06GdvsilDspMk/qmRzpk8LOUStP6jFAbSRi40W09DhoyUn+Mj7eyKICPqeYKybOjVFLVIAQzvu1bfIa7Q==", "license": "MIT", "engines": { "node": ">=20" }, "peerDependencies": { - "hono": "^4" + "hono": "^4 || ^5.0.0-0" } }, "node_modules/@modelcontextprotocol/sdk": { @@ -117,18 +117,18 @@ } }, "node_modules/body-parser": { - "version": "2.3.0", - "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz", - "integrity": "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==", + "version": "2.4.0", + "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.4.0.tgz", + "integrity": "sha512-Ifk1KcLrxaGt1occQagQNFNNOqRt1LFuehEnHHzB8Z6cRgIxRU1TBaiIsUiCdA+gy5PL7Y1IX31DNKkRmxtXjQ==", "license": "MIT", "dependencies": { "bytes": "^3.1.2", - "content-type": "^2.0.0", + "content-type": "^2.1.0", "debug": "^4.4.3", "http-errors": "^2.0.1", - "iconv-lite": "^0.7.2", + "iconv-lite": "^0.7.3", "on-finished": "^2.4.1", - "qs": "^6.15.2", + "qs": "^6.16.1", "raw-body": "^3.0.2", "type-is": "^2.1.0" }, @@ -452,9 +452,9 @@ "license": "MIT" }, "node_modules/fast-uri": { - "version": "3.1.8", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz", - "integrity": "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==", + "version": "3.1.9", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.9.tgz", + "integrity": "sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==", "funding": [ { "type": "github", @@ -881,9 +881,9 @@ } }, "node_modules/qs": { - "version": "6.16.0", - "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.0.tgz", - "integrity": "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==", + "version": "6.17.1", + "resolved": "https://registry.npmjs.org/qs/-/qs-6.17.1.tgz", + "integrity": "sha512-jd3COkaKVgGUW+ZHyEHCG9bH7RoaaiWuMgzsIBjUMVjLAaWGWpoUAVwljVvBHxRu/2qEHnadLGZrkutYUBPQJA==", "license": "BSD-3-Clause", "dependencies": { "es-define-property": "^1.0.1", @@ -1188,9 +1188,9 @@ "license": "ISC" }, "node_modules/zod": { - "version": "4.6.5", - "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.5.tgz", - "integrity": "sha512-v5l/aFXZQeai4awLbOpSoHecE9UiMrnfx75tEXLjNonXVARxQ5mOeipTjROUchszUNCqnE+hqAMujRsRHsut2Q==", + "version": "4.6.7", + "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.7.tgz", + "integrity": "sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==", "license": "MIT", "funding": { "url": "https://github.com/sponsors/colinhacks" diff --git a/mcp-server/package.json b/mcp-server/package.json index 993e08b6..21441000 100644 --- a/mcp-server/package.json +++ b/mcp-server/package.json @@ -9,6 +9,7 @@ "computer-mcp": "bin/cli.js" }, "files": [ + "LICENSE", "index.js", "tools.js", "policy.js", @@ -62,6 +63,6 @@ "security" ], "dependencies": { - "@modelcontextprotocol/sdk": "^1.0.0" + "@modelcontextprotocol/sdk": "^1.32.1" } } From e083e0236a76eb67c7b2f764506c8a20848b9d8c Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Fri, 30 Oct 2026 12:06:57 +0100 Subject: [PATCH 05/94] ci: mutationsporten viser halen af en proeve der er roed uden mutation 0.4.1-LISTE #4: baggrund-mus og stop-alle var roede umuteret paa Fremmed Mac (39986282787), men groenne alene lokalt - porten smed outputtet vaek, saa aarsagen kunne ikke ses. Proevet med en roed og en groen attrap-proeve. Co-Authored-By: Claude Opus 5.5 --- .github/mutant-porte.py | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/mutant-porte.py b/.github/mutant-porte.py index e17a659f..f8ccc593 100644 --- a/.github/mutant-porte.py +++ b/.github/mutant-porte.py @@ -18,10 +18,14 @@ k = subprocess.run(['node', proeve], capture_output=True, text=True, timeout=600, env={**os.environ, 'TMPDIR': tmp + '/'}) groen[proeve] = k.returncode == 0 except subprocess.TimeoutExpired: - groen[proeve] = False + groen[proeve] = False; k = None finally: shutil.rmtree(tmp, ignore_errors=True) - if not groen[proeve]: print(f"::error::proeven {proeve} er ROED uden mutation - dens mutanter er ikke bevist") + if not groen[proeve]: + print(f"::error::proeven {proeve} er ROED uden mutation - dens mutanter er ikke bevist") + # 30/10 (0.4.1-LISTE #4): uden hvorfor kunne ingen se, at baggrund-mus/stop-alle kun var roede her - vis halen. + ud = ((k.stdout or '') + (k.stderr or '')).splitlines() if k else ['timeout efter 600 s'] + print(f"::group::{proeve} umuteret - de sidste linjer"); print('\n'.join(ud[-40:])); print("::endgroup::") for m in MUTANTER: if not groen.get(m['proeve']): fejl.append(f"{m['navn']}: proeven {m['proeve']} er roed uden mutation"); continue From 764b941898d58bca747e5ea6d27e47ccbb3c1a4a Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Fri, 30 Oct 2026 16:05:02 +0100 Subject: [PATCH 06/94] test: stille-vej-kommentaren naevner ikke index.js - tilstand-isoleret laeste den som serverstartende MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fremmed Mac 41045721377: tilstand-isoleret DUMP «stille-vej.mjs» - maaleren kalder en fil serverstartende ved spawn( + index.js, og 9828cf2's kommentar «index.js:1325-1328» udloeste den. Foer: 1 DUMP, efter: alle tjek bestaaet (lokalt). Co-Authored-By: Claude Opus 5.5 --- test/stille-vej.mjs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/stille-vej.mjs b/test/stille-vej.mjs index d4ba477c..022b5925 100644 --- a/test/stille-vej.mjs +++ b/test/stille-vej.mjs @@ -291,7 +291,7 @@ try { sprang('leverer vi i det program mennesket SIDDER i, indroemmer den det', ROER_GRUND); } else if (forrestNavn) { // 0.4.1: siden ed09c85 (10/10) kraever hjaelperen et punkt sammen med --app (main.swift:1020) - samme punkt som - // serveren selv giver (index.js:1325-1328): midten af programmets forreste vindue. + // serveren selv giver (computer_scroll i mcp-server, linje 1325-1328): midten af programmets forreste vindue. const vf = (koer('windows', '--app', forrestNavn).windows || [])[0]?.frame; const eget = vf ? koer('scroll', '--dx', '0', '--dy', '0', '--app', forrestNavn, '--x', String(vf.x + vf.w / 2), '--y', String(vf.y + vf.h / 2)) : { took_screen: null, error: `${forrestNavn} har intet vindue at rulle i` }; From f3367cd9dcde29d8cb4ee7818373a3c41d674728 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Sat, 31 Oct 2026 23:36:19 +0100 Subject: [PATCH 07/94] 0.4.1: version og CHANGELOG Versionen 0.4.1 i package.json, server.json (x2), bundle/manifest.json, gemini-extension.json og HELPER_VERSION. README-loggen genereret med scripts/log-uddrag.mjs (test/readme-log.mjs groen). CHANGELOG: samtykketeksten (D2), LICENSE, underpakkerne (audit 5 -> 0), flere agenter paa macOS 15.8 (Finder kom kort frem i 2 af 5 koersler, som forsidens optagelse viser; skrivningen foran holdt i alle) og proeverettelserne. claims-offline + tjek-forside groenne lokalt. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 26 ++++++++++++++++++++++++++ README.md | 10 +++++----- bundle/manifest.json | 2 +- gemini-extension.json | 2 +- helper/Sources/cmcp-helper/main.swift | 2 +- mcp-server/README.md | 10 +++++----- mcp-server/package-lock.json | 4 ++-- mcp-server/package.json | 2 +- server.json | 4 ++-- test/fixtures/audit-readme.jsonl | 14 +++++++------- 10 files changed, 51 insertions(+), 25 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 19c072e1..9f685795 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,32 @@ Dates are the day the version was tagged. Everything here was measured before it was written down; where a claim has a test, the test is named. +## 0.4.1 (in progress) + +**The consent box no longer says password apps ask while the agent works in the +background.** In the background they are refused outright, but the box said +"Password apps still always ask". It now says "Password apps stay refused while +it works in the background." The text shown in the foreground was already true. +`test/ikon-godkend.mjs` D2 checks the wording, and fails with the old text. + +**The MIT license ships with the package.** Neither the npm package nor the MCPB +bundle carried `LICENSE`; both do now. + +**Patched dependencies.** The MCP SDK now has to be at least 1.32.1, and the +lockfile uses the patched versions of zod, body-parser, @hono/node-server, +fast-uri and qs - the ones a fresh `npx` install gets today. +`npm audit --omit=dev` went from 5 findings to 0. + +**Several agents at once, on GitHub's macOS 15.8 runner.** In 2 of 5 runs with +10 or 15 agents working in the background, Finder came forward for a moment +during a step that used Finder or the wallpaper setting - the same thing the +recording on the front page shows. It is not fixed in this version. The test +that types in front kept every word in those runs. + +**Tests.** `test/stille-vej.mjs` gives `scroll --app` a point, as 0.4.0's helper +requires; on a foreign Mac that check had failed on 0.4.0. The +mutation gate now prints why a test failed before anything was mutated. + ## 0.4.0 (in progress) **A stop lets go of the mouse button and starts nothing new.** A drag holds the diff --git a/README.md b/README.md index e8a14efd..1b219823 100644 --- a/README.md +++ b/README.md @@ -133,11 +133,11 @@ and that its chain holds. ```jsonl -{"ts":"2026-10-20T18:52:45.701Z","session":"fabb2663","call":"746fffee","tool":"computer_type","tier":"write","args":{"app":{"length":8,"sha256_12":"1b330dc3a979","salted":true},"text":{"length":37,"sha256_12":"51f664abcb74","salted":true}},"target":"com.apple.TextEdit","mode":"allow","asker":"custom","decision":"allowed","asked":false,"reason":"CMCP_MODE=allow","l":1,"kaede":"e02a3d1b3560ea17"} -{"ts":"2026-10-20T18:52:45.705Z","session":"fabb2663","call":"746fffee","tool":"computer_type","tier":"write","target":"com.apple.TextEdit","phase":"executing","l":1,"kaede":"c1e763106513c3e7"} -{"ts":"2026-10-20T18:52:46.112Z","session":"fabb2663","call":"746fffee","tool":"computer_type","outcome":"ok","effect":"sent","l":1,"kaede":"b053781eb3511c4d"} -{"ts":"2026-10-20T18:52:47.761Z","session":"fabb2663","call":"88f2d9ae","tool":"computer_menu","tier":"write","args":{"app":{"length":6,"sha256_12":"0771e2f86fa0","salted":true},"path":"File > Move to Trash"},"target":"com.apple.finder","mode":"allow","asker":"menubar","presence":{"idle_at_ask":600,"idle_at_end":600,"server":"0.4.0","icon":"0.4.0","box":"on","sessions":1,"surface_derived":"box+menu"},"decision":"denied","asked":true,"reason":"background mode: nobody answered in the menu bar in time","l":1,"kaede":"9b82d6ae5a36942d"} -{"ts":"2026-10-20T18:52:48.229Z","session":"fabb2663","call":"0ba79155","tool":"computer_type","tier":"write","args":{"app":{"length":9,"sha256_12":"84b5a01fae6a","salted":true},"text":{"length":7,"sha256_12":"b56e1d9fbfd2","salted":true}},"target":"com.1password.1password","mode":"allow","asker":"custom","decision":"denied","asked":false,"reason":"background mode: this would need a dialog, and a dialog takes the screen (a password app can never be approved from the menu bar)","l":1,"kaede":"1be981d7eeaf7445"} +{"ts":"2026-10-31T22:35:10.230Z","session":"56f00545","call":"02bc741b","tool":"computer_type","tier":"write","args":{"app":{"length":8,"sha256_12":"78743a52a54c","salted":true},"text":{"length":37,"sha256_12":"cdde26c85cca","salted":true}},"target":"com.apple.TextEdit","mode":"allow","asker":"custom","decision":"allowed","asked":false,"reason":"CMCP_MODE=allow","l":1,"kaede":"4fb5f61a6e442962"} +{"ts":"2026-10-31T22:35:10.231Z","session":"56f00545","call":"02bc741b","tool":"computer_type","tier":"write","target":"com.apple.TextEdit","phase":"executing","l":1,"kaede":"13cd03c71bfb3b38"} +{"ts":"2026-10-31T22:35:10.321Z","session":"56f00545","call":"02bc741b","tool":"computer_type","outcome":"ok","effect":"sent","l":1,"kaede":"79696176e8603981"} +{"ts":"2026-10-31T22:35:11.481Z","session":"56f00545","call":"ac33c074","tool":"computer_menu","tier":"write","args":{"app":{"length":6,"sha256_12":"2c65732d0d4e","salted":true},"path":"File > Move to Trash"},"target":"com.apple.finder","mode":"allow","asker":"menubar","presence":{"idle_at_ask":600,"idle_at_end":600,"server":"0.4.1","icon":"0.4.1","box":"on","sessions":1,"surface_derived":"box+menu"},"decision":"denied","asked":true,"reason":"background mode: nobody answered in the menu bar in time","l":1,"kaede":"ad20dddb1195fa7a"} +{"ts":"2026-10-31T22:35:11.578Z","session":"56f00545","call":"5b15b900","tool":"computer_type","tier":"write","args":{"app":{"length":9,"sha256_12":"ac0afc1b1e97","salted":true},"text":{"length":7,"sha256_12":"f0b579393774","salted":true}},"target":"com.1password.1password","mode":"allow","asker":"custom","decision":"denied","asked":false,"reason":"background mode: this would need a dialog, and a dialog takes the screen (a password app can never be approved from the menu bar)","l":1,"kaede":"2332aa9606dd896e"} ``` diff --git a/bundle/manifest.json b/bundle/manifest.json index e7eb8798..8d2f2313 100644 --- a/bundle/manifest.json +++ b/bundle/manifest.json @@ -2,7 +2,7 @@ "manifest_version": "0.3", "name": "computer-mcp", "display_name": "Computer MCP", - "version": "0.4.0", + "version": "0.4.1", "description": "macOS computer use you can leave running: it stays behind your window and never touches passwords.", "long_description": "A macOS computer-use MCP server built for the hours you are not watching. It acts in windows behind the one you are in and leaves your pointer alone, it says so when something fails, several can run at once, and it will not go near your password manager. Every action is written to an append-only audit log. Runs in any MCP client, macOS, MIT, no account.", "author": { diff --git a/gemini-extension.json b/gemini-extension.json index 6805b233..c78cae35 100644 --- a/gemini-extension.json +++ b/gemini-extension.json @@ -1,6 +1,6 @@ { "name": "computer-mcp", - "version": "0.4.0", + "version": "0.4.1", "description": "Drive macOS from any MCP client with the guardrails on by default: password fields blacked out in memory before the screenshot is written, password managers that are refused and terminals that ask once per session, and a log the server only appends to that never stores typed text in clear. 32 tools, 14 read-only. No API key, MIT.", "mcpServers": { "computer": { diff --git a/helper/Sources/cmcp-helper/main.swift b/helper/Sources/cmcp-helper/main.swift index 70b6f38f..15ef87d7 100644 --- a/helper/Sources/cmcp-helper/main.swift +++ b/helper/Sources/cmcp-helper/main.swift @@ -22,7 +22,7 @@ func modtager(_ args: Args) -> pid_t? { } -let HELPER_VERSION = "0.4.0" +let HELPER_VERSION = "0.4.1" /// ⛔ 9/10 (F1 paa Gustavs Mac): `--app` blev sammenlignet med programnavne paa /// tyve steder hver for sig (find, vinduer, skaermbilleder, sloering, levering). diff --git a/mcp-server/README.md b/mcp-server/README.md index 5008e47c..4db9f3e3 100644 --- a/mcp-server/README.md +++ b/mcp-server/README.md @@ -131,11 +131,11 @@ and that its chain holds. ```jsonl -{"ts":"2026-10-20T18:52:45.701Z","session":"fabb2663","call":"746fffee","tool":"computer_type","tier":"write","args":{"app":{"length":8,"sha256_12":"1b330dc3a979","salted":true},"text":{"length":37,"sha256_12":"51f664abcb74","salted":true}},"target":"com.apple.TextEdit","mode":"allow","asker":"custom","decision":"allowed","asked":false,"reason":"CMCP_MODE=allow","l":1,"kaede":"e02a3d1b3560ea17"} -{"ts":"2026-10-20T18:52:45.705Z","session":"fabb2663","call":"746fffee","tool":"computer_type","tier":"write","target":"com.apple.TextEdit","phase":"executing","l":1,"kaede":"c1e763106513c3e7"} -{"ts":"2026-10-20T18:52:46.112Z","session":"fabb2663","call":"746fffee","tool":"computer_type","outcome":"ok","effect":"sent","l":1,"kaede":"b053781eb3511c4d"} -{"ts":"2026-10-20T18:52:47.761Z","session":"fabb2663","call":"88f2d9ae","tool":"computer_menu","tier":"write","args":{"app":{"length":6,"sha256_12":"0771e2f86fa0","salted":true},"path":"File > Move to Trash"},"target":"com.apple.finder","mode":"allow","asker":"menubar","presence":{"idle_at_ask":600,"idle_at_end":600,"server":"0.4.0","icon":"0.4.0","box":"on","sessions":1,"surface_derived":"box+menu"},"decision":"denied","asked":true,"reason":"background mode: nobody answered in the menu bar in time","l":1,"kaede":"9b82d6ae5a36942d"} -{"ts":"2026-10-20T18:52:48.229Z","session":"fabb2663","call":"0ba79155","tool":"computer_type","tier":"write","args":{"app":{"length":9,"sha256_12":"84b5a01fae6a","salted":true},"text":{"length":7,"sha256_12":"b56e1d9fbfd2","salted":true}},"target":"com.1password.1password","mode":"allow","asker":"custom","decision":"denied","asked":false,"reason":"background mode: this would need a dialog, and a dialog takes the screen (a password app can never be approved from the menu bar)","l":1,"kaede":"1be981d7eeaf7445"} +{"ts":"2026-10-31T22:35:10.230Z","session":"56f00545","call":"02bc741b","tool":"computer_type","tier":"write","args":{"app":{"length":8,"sha256_12":"78743a52a54c","salted":true},"text":{"length":37,"sha256_12":"cdde26c85cca","salted":true}},"target":"com.apple.TextEdit","mode":"allow","asker":"custom","decision":"allowed","asked":false,"reason":"CMCP_MODE=allow","l":1,"kaede":"4fb5f61a6e442962"} +{"ts":"2026-10-31T22:35:10.231Z","session":"56f00545","call":"02bc741b","tool":"computer_type","tier":"write","target":"com.apple.TextEdit","phase":"executing","l":1,"kaede":"13cd03c71bfb3b38"} +{"ts":"2026-10-31T22:35:10.321Z","session":"56f00545","call":"02bc741b","tool":"computer_type","outcome":"ok","effect":"sent","l":1,"kaede":"79696176e8603981"} +{"ts":"2026-10-31T22:35:11.481Z","session":"56f00545","call":"ac33c074","tool":"computer_menu","tier":"write","args":{"app":{"length":6,"sha256_12":"2c65732d0d4e","salted":true},"path":"File > Move to Trash"},"target":"com.apple.finder","mode":"allow","asker":"menubar","presence":{"idle_at_ask":600,"idle_at_end":600,"server":"0.4.1","icon":"0.4.1","box":"on","sessions":1,"surface_derived":"box+menu"},"decision":"denied","asked":true,"reason":"background mode: nobody answered in the menu bar in time","l":1,"kaede":"ad20dddb1195fa7a"} +{"ts":"2026-10-31T22:35:11.578Z","session":"56f00545","call":"5b15b900","tool":"computer_type","tier":"write","args":{"app":{"length":9,"sha256_12":"ac0afc1b1e97","salted":true},"text":{"length":7,"sha256_12":"f0b579393774","salted":true}},"target":"com.1password.1password","mode":"allow","asker":"custom","decision":"denied","asked":false,"reason":"background mode: this would need a dialog, and a dialog takes the screen (a password app can never be approved from the menu bar)","l":1,"kaede":"2332aa9606dd896e"} ``` diff --git a/mcp-server/package-lock.json b/mcp-server/package-lock.json index c00b0792..1ba98a52 100644 --- a/mcp-server/package-lock.json +++ b/mcp-server/package-lock.json @@ -1,12 +1,12 @@ { "name": "@agent360/computer-mcp", - "version": "0.4.0", + "version": "0.4.1", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@agent360/computer-mcp", - "version": "0.4.0", + "version": "0.4.1", "license": "MIT", "dependencies": { "@modelcontextprotocol/sdk": "^1.32.1" diff --git a/mcp-server/package.json b/mcp-server/package.json index 21441000..7379713f 100644 --- a/mcp-server/package.json +++ b/mcp-server/package.json @@ -1,6 +1,6 @@ { "name": "@agent360/computer-mcp", - "version": "0.4.0", + "version": "0.4.1", "mcpName": "io.github.Agent360dk/computer-mcp", "description": "Computer use you can actually leave running. It works in windows behind the one you are in and leaves your pointer alone, it says so when something fails instead of pretending, several can run at once, and it will not go near your password manager. Everything is logged. macOS, MIT, no account.", "type": "module", diff --git a/server.json b/server.json index 180e7f63..b60c1a4f 100644 --- a/server.json +++ b/server.json @@ -7,13 +7,13 @@ "url": "https://github.com/Agent360dk/computerMCP", "source": "github" }, - "version": "0.4.0", + "version": "0.4.1", "websiteUrl": "https://computermcp.dev", "packages": [ { "registryType": "npm", "identifier": "@agent360/computer-mcp", - "version": "0.4.0", + "version": "0.4.1", "transport": { "type": "stdio" }, diff --git a/test/fixtures/audit-readme.jsonl b/test/fixtures/audit-readme.jsonl index f40fea94..b3e33785 100644 --- a/test/fixtures/audit-readme.jsonl +++ b/test/fixtures/audit-readme.jsonl @@ -1,7 +1,7 @@ -{"ts":"2026-10-20T18:52:44.507Z","session":"fabb2663","call":"13634812","tool":"computer_apps","tier":"read","args":{},"target":null,"mode":"allow","asker":"custom","decision":"allowed","asked":false,"reason":"read-only action","l":1,"kaede":"ad0c114e049b146c"} -{"ts":"2026-10-20T18:52:45.180Z","session":"fabb2663","call":"13634812","tool":"computer_apps","outcome":"ok","l":1,"kaede":"3028db917a702ec3"} -{"ts":"2026-10-20T18:52:45.701Z","session":"fabb2663","call":"746fffee","tool":"computer_type","tier":"write","args":{"app":{"length":8,"sha256_12":"1b330dc3a979","salted":true},"text":{"length":37,"sha256_12":"51f664abcb74","salted":true}},"target":"com.apple.TextEdit","mode":"allow","asker":"custom","decision":"allowed","asked":false,"reason":"CMCP_MODE=allow","l":1,"kaede":"e02a3d1b3560ea17"} -{"ts":"2026-10-20T18:52:45.705Z","session":"fabb2663","call":"746fffee","tool":"computer_type","tier":"write","target":"com.apple.TextEdit","phase":"executing","l":1,"kaede":"c1e763106513c3e7"} -{"ts":"2026-10-20T18:52:46.112Z","session":"fabb2663","call":"746fffee","tool":"computer_type","outcome":"ok","effect":"sent","l":1,"kaede":"b053781eb3511c4d"} -{"ts":"2026-10-20T18:52:47.761Z","session":"fabb2663","call":"88f2d9ae","tool":"computer_menu","tier":"write","args":{"app":{"length":6,"sha256_12":"0771e2f86fa0","salted":true},"path":"File > Move to Trash"},"target":"com.apple.finder","mode":"allow","asker":"menubar","presence":{"idle_at_ask":600,"idle_at_end":600,"server":"0.4.0","icon":"0.4.0","box":"on","sessions":1,"surface_derived":"box+menu"},"decision":"denied","asked":true,"reason":"background mode: nobody answered in the menu bar in time","l":1,"kaede":"9b82d6ae5a36942d"} -{"ts":"2026-10-20T18:52:48.229Z","session":"fabb2663","call":"0ba79155","tool":"computer_type","tier":"write","args":{"app":{"length":9,"sha256_12":"84b5a01fae6a","salted":true},"text":{"length":7,"sha256_12":"b56e1d9fbfd2","salted":true}},"target":"com.1password.1password","mode":"allow","asker":"custom","decision":"denied","asked":false,"reason":"background mode: this would need a dialog, and a dialog takes the screen (a password app can never be approved from the menu bar)","l":1,"kaede":"1be981d7eeaf7445"} +{"ts":"2026-10-31T22:35:09.449Z","session":"56f00545","call":"7fb6f0ce","tool":"computer_apps","tier":"read","args":{},"target":null,"mode":"allow","asker":"custom","decision":"allowed","asked":false,"reason":"read-only action","l":1,"kaede":"97f43c51a40454c5"} +{"ts":"2026-10-31T22:35:10.129Z","session":"56f00545","call":"7fb6f0ce","tool":"computer_apps","outcome":"ok","l":1,"kaede":"f547259cf8faa803"} +{"ts":"2026-10-31T22:35:10.230Z","session":"56f00545","call":"02bc741b","tool":"computer_type","tier":"write","args":{"app":{"length":8,"sha256_12":"78743a52a54c","salted":true},"text":{"length":37,"sha256_12":"cdde26c85cca","salted":true}},"target":"com.apple.TextEdit","mode":"allow","asker":"custom","decision":"allowed","asked":false,"reason":"CMCP_MODE=allow","l":1,"kaede":"4fb5f61a6e442962"} +{"ts":"2026-10-31T22:35:10.231Z","session":"56f00545","call":"02bc741b","tool":"computer_type","tier":"write","target":"com.apple.TextEdit","phase":"executing","l":1,"kaede":"13cd03c71bfb3b38"} +{"ts":"2026-10-31T22:35:10.321Z","session":"56f00545","call":"02bc741b","tool":"computer_type","outcome":"ok","effect":"sent","l":1,"kaede":"79696176e8603981"} +{"ts":"2026-10-31T22:35:11.481Z","session":"56f00545","call":"ac33c074","tool":"computer_menu","tier":"write","args":{"app":{"length":6,"sha256_12":"2c65732d0d4e","salted":true},"path":"File > Move to Trash"},"target":"com.apple.finder","mode":"allow","asker":"menubar","presence":{"idle_at_ask":600,"idle_at_end":600,"server":"0.4.1","icon":"0.4.1","box":"on","sessions":1,"surface_derived":"box+menu"},"decision":"denied","asked":true,"reason":"background mode: nobody answered in the menu bar in time","l":1,"kaede":"ad20dddb1195fa7a"} +{"ts":"2026-10-31T22:35:11.578Z","session":"56f00545","call":"5b15b900","tool":"computer_type","tier":"write","args":{"app":{"length":9,"sha256_12":"ac0afc1b1e97","salted":true},"text":{"length":7,"sha256_12":"f0b579393774","salted":true}},"target":"com.1password.1password","mode":"allow","asker":"custom","decision":"denied","asked":false,"reason":"background mode: this would need a dialog, and a dialog takes the screen (a password app can never be approved from the menu bar)","l":1,"kaede":"2332aa9606dd896e"} From 187f60b62ce2f0f4e7fe2ac7982e9ae318d910be Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Sun, 1 Nov 2026 04:05:10 +0100 Subject: [PATCH 08/94] test/ci: vaernet mod fejltilskrivning ogsaa paa GitHubs Mac, release.sh ser 100 CI-koersler, laasefilen = en frisk npx-installation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Panel R1 1/11 (Astra + Opus, efterproevet): - parallel.mjs: menneskeArbejder var EGEN, saa paa GitHubs Mac fik et rent laesende scenarie skylden for Finder-momentet (41128683401: «101 laese Finder 1», kun computer_windows + computer_find, Finder foer -> TextEdit efter). - release.sh:163 saa kun de seneste 20 CI-koersler; 627b710 er nr. 7 - 13 koersler paa en anden gren afviste udgivelsen. - package-lock.json = en frisk opløsning af package.json i dag (SDK 1.32.2, express 5.3.0 ...): npx har ingen laasefil, saa proeverne skal koere det brugerne faar. npm audit --omit=dev: 0. Co-Authored-By: Claude Opus 5.5 --- mcp-server/package-lock.json | 87 ++++++++++++++++++++++-------------- scripts/release.sh | 2 +- test/parallel.mjs | 4 +- 3 files changed, 58 insertions(+), 35 deletions(-) diff --git a/mcp-server/package-lock.json b/mcp-server/package-lock.json index 1ba98a52..91af9a44 100644 --- a/mcp-server/package-lock.json +++ b/mcp-server/package-lock.json @@ -31,9 +31,9 @@ } }, "node_modules/@modelcontextprotocol/sdk": { - "version": "1.32.1", - "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.32.1.tgz", - "integrity": "sha512-2DdE+SJDtzLEEWzY1ZjY7Q+VcPhcV1KisD3zI4u0XZyktsjHum1mwbMI+JaulUBi2OZk+KJAi2uPXzxichPkdw==", + "version": "1.32.2", + "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.32.2.tgz", + "integrity": "sha512-SWsVtH/0vULSQStoZ6xxH2K09Li8fXYTMC64ZeogCdpZ3XSi1eCPOByV1OpuJxuI3OcmHhosDWYyii07tpPsLw==", "license": "MIT", "dependencies": { "@hono/node-server": "^1.19.9 || ^2.0.5", @@ -192,9 +192,9 @@ } }, "node_modules/content-disposition": { - "version": "1.1.0", - "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-1.1.0.tgz", - "integrity": "sha512-5jRCH9Z/+DRP7rkvY83B+yGIGX96OYdJmzngqnw2SBSxqCFPd0w2km3s5iawpGX8krnwSGmF0FW5Nhr0Hfai3g==", + "version": "2.0.1", + "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-2.0.1.tgz", + "integrity": "sha512-e+H0ZXHSWYrENhQzw1LPuP4oF5MzVKmDU6d3hxlvaPEYLLg62MxtQNPRx4SYSuYJSBUgnQIG4HIN2tEtNv7Dog==", "license": "MIT", "engines": { "node": ">=18" @@ -309,12 +309,16 @@ "license": "MIT" }, "node_modules/encodeurl": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.0.tgz", - "integrity": "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==", + "version": "2.0.1", + "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.1.tgz", + "integrity": "sha512-Ev/hIyePLZtpL98x562lvPtenrUfGr0lfaf44HFZ+hDEwso7ccV9QAZrEVLg0hxNAzygaAFxy2dYaAKKM0G06A==", "license": "MIT", "engines": { "node": ">= 0.8" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" } }, "node_modules/es-define-property": { @@ -384,15 +388,15 @@ } }, "node_modules/express": { - "version": "5.2.1", - "resolved": "https://registry.npmjs.org/express/-/express-5.2.1.tgz", - "integrity": "sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw==", + "version": "5.3.0", + "resolved": "https://registry.npmjs.org/express/-/express-5.3.0.tgz", + "integrity": "sha512-qCqy1xSoaugxOD4IVHb1ZWdkvCF2W3aE2okKouWj8VwJ+ztskSiXoBnCSJqfKT+cVPJhuJqe9YLbY425+Zh00g==", "license": "MIT", "dependencies": { "accepts": "^2.0.0", - "body-parser": "^2.2.1", - "content-disposition": "^1.0.0", - "content-type": "^1.0.5", + "body-parser": "^2.3.0", + "content-disposition": "^2.0.1", + "content-type": "^2.0.0", "cookie": "^0.7.1", "cookie-signature": "^1.2.1", "debug": "^4.4.0", @@ -408,14 +412,14 @@ "on-finished": "^2.4.1", "once": "^1.4.0", "parseurl": "^1.3.3", - "proxy-addr": "^2.0.7", - "qs": "^6.14.0", + "proxy-addr": "^2.0.8", + "qs": "^6.16.0", "range-parser": "^1.2.1", "router": "^2.2.0", "send": "^1.1.0", "serve-static": "^2.2.0", "statuses": "^2.0.1", - "type-is": "^2.0.1", + "type-is": "^2.1.0", "vary": "^1.1.2" }, "engines": { @@ -427,9 +431,9 @@ } }, "node_modules/express-rate-limit": { - "version": "8.7.0", - "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.7.0.tgz", - "integrity": "sha512-hOwV7WOxXfjRpAM1DSJWZDXx3GhplwD8IfwuwvogD8i1Qnkgosw/H45s4ZnFAUHDAhPjlY9hLBvJhKmGMyY26g==", + "version": "8.7.2", + "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.7.2.tgz", + "integrity": "sha512-U1ScocxDD9WI09LaBVypvNkOtNR5yWAmZLkuKJdAzIchA4YKFYF6GT5IKER7epG58oXtjvGlV0/6ii0F83EyZg==", "license": "MIT", "dependencies": { "debug": "^4.4.3", @@ -445,6 +449,19 @@ "express": ">= 4.11" } }, + "node_modules/express/node_modules/content-type": { + "version": "2.1.0", + "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.1.0.tgz", + "integrity": "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==", + "license": "MIT", + "engines": { + "node": ">=18" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + } + }, "node_modules/fast-deep-equal": { "version": "3.1.3", "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz", @@ -589,9 +606,9 @@ } }, "node_modules/hono": { - "version": "4.13.13", - "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.13.tgz", - "integrity": "sha512-CQ46U0ZkAGmbT/4UxdzzGJpacP2IeKgY4a5/tOI9AABbpOMfK739wfDXmv1usCk+3RkKj1hQy4/fjhiwa2xlrA==", + "version": "4.13.15", + "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.15.tgz", + "integrity": "sha512-BTUf5VVhV+eb9owxdzdfQBV6b7Uvh7oDPMMHOmpa9hRe9/fKUI5b3TsGiDro2R3hPl3cPT5FuGmb32H3MqReug==", "license": "MIT", "engines": { "node": ">=16.9.0" @@ -640,9 +657,9 @@ "license": "ISC" }, "node_modules/ip-address": { - "version": "10.7.4", - "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.4.tgz", - "integrity": "sha512-DWBMKyeM25D70nrIiTkgQth59/G+naKOTep6huF9j+GmeK3DMD60Zvxg5d5qQnz+38AHgou6ean2LECX+lrKDg==", + "version": "10.7.5", + "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.5.tgz", + "integrity": "sha512-t2v0rkILYv9WXmSL7TpAaU3HXgaFYOPUcH3QHgwQ++gpJuH3bqyMy4Fvt/DJCTKwzH3Cf+bAp5W/mFL39KPLzA==", "license": "MIT", "engines": { "node": ">= 12" @@ -670,9 +687,9 @@ "license": "ISC" }, "node_modules/jose": { - "version": "6.2.12", - "resolved": "https://registry.npmjs.org/jose/-/jose-6.2.12.tgz", - "integrity": "sha512-9NiFmJEex0sy2Dk58j2UGBSHgUs2ypF9eZSu4L6vjOX3Dp96Sw1F3uL+H+D1sx02jZZdzUT0HgvCy59CuvXcWw==", + "version": "6.2.14", + "resolved": "https://registry.npmjs.org/jose/-/jose-6.2.14.tgz", + "integrity": "sha512-3JasLuki1NRLQvY4wCoC37KZk4qxoBx2k2aFqLxT84IezqW0bkJKnNtxnZj/Fu1xsQivoc/lytxaRHJoGLjJ1A==", "license": "MIT", "funding": { "url": "https://github.com/sponsors/panva" @@ -806,15 +823,19 @@ } }, "node_modules/on-finished": { - "version": "2.4.1", - "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz", - "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==", + "version": "2.4.2", + "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.2.tgz", + "integrity": "sha512-ATWUv387i+nLD49EiDoOft5scf32Vsdz3ktrQJG9bi7jRFmaXTssvyvj1EmeKVVgvesbqUtvQQvaS2TpTukAZQ==", "license": "MIT", "dependencies": { "ee-first": "1.1.1" }, "engines": { "node": ">= 0.8" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" } }, "node_modules/once": { diff --git a/scripts/release.sh b/scripts/release.sh index 21d6efba..666f7aa1 100755 --- a/scripts/release.sh +++ b/scripts/release.sh @@ -160,7 +160,7 @@ echo "== 2b/7 CI skal vaere groen paa den commit der udgives ==" HEADSHA=$(git rev-parse HEAD) # ⛔ 7/10 (panel R8, E): en fejlet forespoergsel (net, GitHub-timeout) blev under # set -e enten et tavst stop eller laest som «CI har ikke koert». Den er UKENDT. -if ! CIDOM=$(gh run list -R Agent360dk/computerMCP -w CI --limit 20 \ +if ! CIDOM=$(gh run list -R Agent360dk/computerMCP -w CI --limit 100 \ --json headSha,conclusion,status \ -q "[.[] | select(.headSha==\"$HEADSHA\")] | .[0].conclusion" 2>/dev/null); then echo "⛔ CI-status kunne ikke laeses fra GitHub (net eller timeout) - den er UKENDT, ikke «ikke koert»." diff --git a/test/parallel.mjs b/test/parallel.mjs index 8967e699..6092f15f 100644 --- a/test/parallel.mjs +++ b/test/parallel.mjs @@ -194,7 +194,9 @@ for (const n of NIVEAUER) { const t0 = Date.now(); // Én delt state-mappe pr. runde: programlaas og revisionskaede deles, som paa en rigtig Mac. const delt = mkdtempSync(join(tmpdir(), 'cmcp-parallel-state-')); - const res = await Promise.all(hold.map(s => koerScenarie(s, { film: false, menneskeArbejder: EGEN, stateDir: delt }))); + // 1/11 (panel R1, Opus): paa GitHubs Mac skriver en proeve ogsaa i TextEdit, saa et skift TILBAGE til TextEdit er + // menneskets program, ikke scenariets. Uden vaernet fik et rent laesende scenarie skylden for Finder-momentet. + const res = await Promise.all(hold.map(s => koerScenarie(s, { film: false, menneskeArbejder: FREMMED || EGEN, stateDir: delt }))); const sek = ((Date.now() - t0) / 1000).toFixed(1); await vent(2500); // et program kan hente sig selv frem sekunder efter (Kontakter, 27/9) const maaling = await vagt.stop(); From ebf174256ab1df171dca4e7054ae3f3423ea05fc Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Sun, 1 Nov 2026 04:05:10 +0100 Subject: [PATCH 09/94] 0.4.1: CHANGELOG efter panel R1 + installationssiderne siger 0.4.1 (sync-tal.py) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Underpakker: beskriver vores laasefil, ikke brugerens (npx opløser selv; de 5 fund var kun i vores trae). - Flere agenter: Finder kommer frem to gange paa hvert niveau i alle seks koersler, 15.7 og 15.8, op til 2,8 s - ikke «2 af 5». - LICENSE: npm maalt, MCPB via samme filliste. Mutationsporten «viser de sidste linjer», ikke «hvorfor». - Rettet: 0.2.1-saetningen «Password managers ask every single time, in every mode». Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 47 ++++++++++++++------- docs/docs/install-claude-code/index.html | 2 +- docs/docs/install-claude-desktop/index.html | 2 +- docs/docs/install-codex/index.html | 2 +- docs/docs/install-copilot/index.html | 2 +- docs/docs/install-cursor/index.html | 2 +- docs/docs/install-vscode/index.html | 2 +- 7 files changed, 37 insertions(+), 22 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 9f685795..b42f3904 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,23 +11,37 @@ background.** In the background they are refused outright, but the box said it works in the background." The text shown in the foreground was already true. `test/ikon-godkend.mjs` D2 checks the wording, and fails with the old text. -**The MIT license ships with the package.** Neither the npm package nor the MCPB -bundle carried `LICENSE`; both do now. - -**Patched dependencies.** The MCP SDK now has to be at least 1.32.1, and the -lockfile uses the patched versions of zod, body-parser, @hono/node-server, -fast-uri and qs - the ones a fresh `npx` install gets today. -`npm audit --omit=dev` went from 5 findings to 0. - -**Several agents at once, on GitHub's macOS 15.8 runner.** In 2 of 5 runs with -10 or 15 agents working in the background, Finder came forward for a moment -during a step that used Finder or the wallpaper setting - the same thing the -recording on the front page shows. It is not fixed in this version. The test -that types in front kept every word in those runs. +**The MIT license ships with the package.** The npm package did not carry +`LICENSE`; it does now (`npm pack` lists it), and the MCPB bundle copies the same +file list. + +**The tests run the dependencies an `npx` user gets.** An `npx` install has no +lockfile and resolves the newest versions in range - today MCP SDK 1.32.2, with +no `npm audit` findings. Our lockfile, which the tests and the MCPB bundle +install from, was older: SDK 1.32.1 and five audit findings (zod, body-parser, +@hono/node-server, fast-uri, qs). It is now the same set a fresh install +resolves. The SDK also has to be at least 1.32.1. + +**Several agents at once.** In the test where 5, 10 and 15 agents work in the +background while another test types into TextEdit, an agent that opens a Finder +window brings Finder forward for a moment, twice at every level, and the front +is handed straight back - the longest such moment measured was 2.8 seconds. It +happened in all six runs on GitHub's Mac, on macOS 15.7 and 15.8 alike, and the +recording on the front page shows the same thing. It is not fixed in this +version. Every word the typing test sent into TextEdit was verified by the +helper (2,663 of 2,663); whether keys typed by hand during such a moment land in +Finder is not measured. The test used to blame whichever agent happened to +start during the moment - even one that only reads - and now judges it on +GitHub's Mac the way it already did on a person's own Mac. **Tests.** `test/stille-vej.mjs` gives `scroll --app` a point, as 0.4.0's helper -requires; on a foreign Mac that check had failed on 0.4.0. The -mutation gate now prints why a test failed before anything was mutated. +requires; on a foreign Mac that check had failed on 0.4.0. The mutation gate now +prints the last lines of a test that fails before anything is mutated. +`scripts/release.sh` looks for the CI run in the last 100 runs, not 20. + +**Corrected.** The 0.2.1 notes below said "Password managers ask every single +time, in every mode." In background mode they are refused, not asked; in the +foreground they ask every time. ## 0.4.0 (in progress) @@ -473,7 +487,8 @@ that it is leaving and the helper finishes the file on its own. A server killed anything. Needs macOS 15. **Consent, as it actually works.** `allow` is the default, so an agent can be -left running. Password managers ask every single time, in every mode. Terminals +left running. Password managers ask every single time, in every mode (corrected +in 0.4.1: in background mode they are refused). Terminals and editors ask once per app per session. Quitting, closing a window, switching Space and destructive-looking menu items ask every time. Several pages said otherwise; they now match the code, and a test derives the forbidden phrasings diff --git a/docs/docs/install-claude-code/index.html b/docs/docs/install-claude-code/index.html index 72f0a00b..53b6b42c 100644 --- a/docs/docs/install-claude-code/index.html +++ b/docs/docs/install-claude-code/index.html @@ -182,7 +182,7 @@

Install Computer MCP for Claude Code

access, window control, moving windows between screens, pasting, opening and quitting apps, waiting for something to appear, writing into a field behind another window, and asking you for a password without the model ever seeing it. -Those ship with 0.4.0, which is built and tested but not published yet.

+Those ship with 0.4.1, which is built and tested but not published yet.

Everything else on this page works with what you install today. If you want all of them now, build from source: about thirty-five seconds, and nothing to download.

diff --git a/docs/docs/install-claude-desktop/index.html b/docs/docs/install-claude-desktop/index.html index ff9754e6..ca07cb9f 100644 --- a/docs/docs/install-claude-desktop/index.html +++ b/docs/docs/install-claude-desktop/index.html @@ -182,7 +182,7 @@

Install Computer MCP for Claude Desktop

access, window control, moving windows between screens, pasting, opening and quitting apps, waiting for something to appear, writing into a field behind another window, and asking you for a password without the model ever seeing it. -Those ship with 0.4.0, which is built and tested but not published yet.

+Those ship with 0.4.1, which is built and tested but not published yet.

Everything else on this page works with what you install today. If you want all of them now, build from source: about thirty-five seconds, and nothing to download.

diff --git a/docs/docs/install-codex/index.html b/docs/docs/install-codex/index.html index a1c7638e..49cd6302 100644 --- a/docs/docs/install-codex/index.html +++ b/docs/docs/install-codex/index.html @@ -182,7 +182,7 @@

Install Computer MCP for OpenAI Codex

access, window control, moving windows between screens, pasting, opening and quitting apps, waiting for something to appear, writing into a field behind another window, and asking you for a password without the model ever seeing it. -Those ship with 0.4.0, which is built and tested but not published yet.

+Those ship with 0.4.1, which is built and tested but not published yet.

Everything else on this page works with what you install today. If you want all of them now, build from source: about thirty-five seconds, and nothing to download.

diff --git a/docs/docs/install-copilot/index.html b/docs/docs/install-copilot/index.html index 17d2856d..ead17a43 100644 --- a/docs/docs/install-copilot/index.html +++ b/docs/docs/install-copilot/index.html @@ -182,7 +182,7 @@

Install Computer MCP for GitHub Copilot

access, window control, moving windows between screens, pasting, opening and quitting apps, waiting for something to appear, writing into a field behind another window, and asking you for a password without the model ever seeing it. -Those ship with 0.4.0, which is built and tested but not published yet.

+Those ship with 0.4.1, which is built and tested but not published yet.

Everything else on this page works with what you install today. If you want all of them now, build from source: about thirty-five seconds, and nothing to download.

diff --git a/docs/docs/install-cursor/index.html b/docs/docs/install-cursor/index.html index dd68e070..fbb5335e 100644 --- a/docs/docs/install-cursor/index.html +++ b/docs/docs/install-cursor/index.html @@ -182,7 +182,7 @@

Install Computer MCP for Cursor

access, window control, moving windows between screens, pasting, opening and quitting apps, waiting for something to appear, writing into a field behind another window, and asking you for a password without the model ever seeing it. -Those ship with 0.4.0, which is built and tested but not published yet.

+Those ship with 0.4.1, which is built and tested but not published yet.

Everything else on this page works with what you install today. If you want all of them now, build from source: about thirty-five seconds, and nothing to download.

diff --git a/docs/docs/install-vscode/index.html b/docs/docs/install-vscode/index.html index 6a3cc578..95a3e983 100644 --- a/docs/docs/install-vscode/index.html +++ b/docs/docs/install-vscode/index.html @@ -182,7 +182,7 @@

Install Computer MCP for VS Code

access, window control, moving windows between screens, pasting, opening and quitting apps, waiting for something to appear, writing into a field behind another window, and asking you for a password without the model ever seeing it. -Those ship with 0.4.0, which is built and tested but not published yet.

+Those ship with 0.4.1, which is built and tested but not published yet.

Everything else on this page works with what you install today. If you want all of them now, build from source: about thirty-five seconds, and nothing to download.

From 8d851c2f9232cfc9ae25b5f0e7361bb5c41107ad Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Sun, 1 Nov 2026 04:44:15 +0100 Subject: [PATCH 10/94] =?UTF-8?q?ci:=20fremmed-mac=20-=20=C2=ABMange=20age?= =?UTF-8?q?nter=C2=BB=20faar=2060=20min,=20og=20mutationsporten=20starter?= =?UTF-8?q?=20med=20Script=20Editor=20forrest=20som=20suiten?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Panel R2 1/11: et svar der aldrig kom braendte 5,5 t (41077418047 forsoeg 1). baggrund-mus bestaar i suiten (Script Editor forrest) men ikke i portens baseline (Finder forrest efter «Mange agenter»): samme udgangspunkt afgoer om det er tilstanden. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/fremmed-mac.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/fremmed-mac.yml b/.github/workflows/fremmed-mac.yml index 1116c052..134713b9 100644 --- a/.github/workflows/fremmed-mac.yml +++ b/.github/workflows/fremmed-mac.yml @@ -167,6 +167,8 @@ jobs: - name: Mange agenter samtidig id: par continue-on-error: true + # 1/11 (panel R2): et svar der aldrig kom, brændte 5,5 t af jobbets 6 (41077418047 forsøg 1) - porten naaede aldrig at skrive. + timeout-minutes: 60 run: | killall Chess Calculator Contacts "System Settings" "Activity Monitor" Notes Safari "Script Editor" 2>/dev/null || true CMCP_FILM="$RUNNER_TEMP/film" CMCP_PARALLEL_RAPPORT="$RUNNER_TEMP/parallel.json" node test/parallel.mjs @@ -223,6 +225,9 @@ jobs: # skal kunne blive roed. bash -e: uden «|| rc» stoppede trinnet ved foerste. run: | rc=0 + # 1/11 (panel R2): «Mange agenter» lukker Script Editor og TextEdit, saa Finder staar forrest her; i suiten + # (Script Editor forrest) bestaar baggrund-mus, i portens baseline ikke. Samme udgangspunkt som suiten. + open -a "Script Editor"; sleep 4 bash .github/mutant-giv-tilbage.sh || rc=1 python3 .github/mutant-porte.py || rc=1 exit $rc From 1003f8987d41e520fe4299c40b9061f51bf173ce Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Sun, 1 Nov 2026 04:44:15 +0100 Subject: [PATCH 11/94] 0.4.1: teksterne efter panel R2 - give-back virker ikke altid, laasefilen dateret, kendte graenser MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - README/npm-README/forside/kapabilitetsmatrix: «handed straight back» faar maalingen med: 1 af 65 momenter (41266330474) kunne ikke gives tilbage, svaret sagde gave_back:false. - CHANGELOG: hovedet lovede datoer der ikke staar der; laasefilen beskrevet som fornyet 1/11 (ikke varig lighed med npx); mange agenter med alle fire udfald; kendte graenser: baggrund-mus/38 mutanter, F2b 3 af 11 (F2 bestod i alle). Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 35 ++++++++++++++++++-------- README.md | 8 +++--- docs/docs/capability-matrix/index.html | 2 +- docs/index.html | 2 +- mcp-server/README.md | 8 +++--- 5 files changed, 36 insertions(+), 19 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index b42f3904..cbf58e7b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,7 +1,7 @@ # Changelog -Dates are the day the version was tagged. Everything here was measured before it -was written down; where a claim has a test, the test is named. +Newest first. Where a claim has a test, the test is named; what is not measured +says so. ## 0.4.1 (in progress) @@ -15,20 +15,25 @@ it works in the background." The text shown in the foreground was already true. `LICENSE`; it does now (`npm pack` lists it), and the MCPB bundle copies the same file list. -**The tests run the dependencies an `npx` user gets.** An `npx` install has no -lockfile and resolves the newest versions in range - today MCP SDK 1.32.2, with -no `npm audit` findings. Our lockfile, which the tests and the MCPB bundle -install from, was older: SDK 1.32.1 and five audit findings (zod, body-parser, -@hono/node-server, fast-uri, qs). It is now the same set a fresh install -resolves. The SDK also has to be at least 1.32.1. +**The lockfile was renewed on 1 November.** An `npx` install has no lockfile and +resolves the newest versions in range; on 1 November that was MCP SDK 1.32.2, +with no `npm audit` findings. 0.4.0's lockfile, which the tests and the MCPB +bundle install from, had SDK 1.32.1 and five audit findings (zod, body-parser, +@hono/node-server, fast-uri, qs). It was replaced that day by a fresh +resolution of this version's `package.json`; newer releases in range can +appear after it. The SDK also has to be at least 1.32.1. **Several agents at once.** In the test where 5, 10 and 15 agents work in the background while another test types into TextEdit, an agent that opens a Finder window brings Finder forward for a moment, twice at every level, and the front is handed straight back - the longest such moment measured was 2.8 seconds. It -happened in all six runs on GitHub's Mac, on macOS 15.7 and 15.8 alike, and the -recording on the front page shows the same thing. It is not fixed in this -version. Every word the typing test sent into TextEdit was verified by the +happened in all six completed runs on GitHub's Mac counted for this note, on +macOS 15.7 and 15.8 alike, and the recording on the front page shows the same +thing. In one of 65 such moments across eleven runs the front could not be +handed back: Finder stayed in front, and the reply said so (`gave_back: +false`). Under load an agent can also stop and wait when it cannot tell which +app the person is in - it then does nothing - and one run hung until GitHub's +time limit. None of this is fixed in this version. Every word the typing test sent into TextEdit was verified by the helper (2,663 of 2,663); whether keys typed by hand during such a moment land in Finder is not measured. The test used to blame whichever agent happened to start during the moment - even one that only reads - and now judges it on @@ -39,6 +44,14 @@ requires; on a foreign Mac that check had failed on 0.4.0. The mutation gate now prints the last lines of a test that fails before anything is mutated. `scripts/release.sh` looks for the CI run in the last 100 runs, not 20. +**Known limits found while measuring 0.4.1.** In the mutation gate on GitHub's +Mac, `test/baggrund-mus.mjs` runs after the many-agents test, with Finder in +front; there a menu opened by a click behind was not closed again +(`menu_closed: false` in the reply), though the same test passes in the suite. +Its 38 mutants are therefore not proven on a foreign Mac. The check that the +helper process ends within 500 ms of a stop failed in 3 of 11 runs (524-546 ms), +on 0.4.0 and 0.4.1 alike; the mouse button was released in all of them (F2). + **Corrected.** The 0.2.1 notes below said "Password managers ask every single time, in every mode." In background mode they are refused, not asked; in the foreground they ask every time. diff --git a/README.md b/README.md index 1b219823..0b8400f6 100644 --- a/README.md +++ b/README.md @@ -13,8 +13,9 @@ in the hours you are not watching. - **It does not take over your Mac.** It presses buttons and fills fields in windows that stay behind the one you are in, and it leaves your pointer where you put it. When an app pulls itself to the front as it opens, the front is - handed straight back and the reply says so - nothing is left stealing what you - are typing. + handed straight back and the reply says so. In one of 65 measured moments like + it (GitHub's Mac, many agents at once) it could not be, and the reply said that too (`gave_back: + false`): until you click back, what you type goes to that app. - **It does not pretend.** When something is refused or fails, it says so and says why. The most common complaint about agents driving a computer is that they carry on as if it worked. @@ -237,7 +238,8 @@ the same way - including when the call failed halfway, because a half-done write that took the screen must not be the one line that stays silent. `press` and `menu` carry it too: an app can bring itself forward in response (measured: File > New Finder Window did), and when it does, the answer says so -and the front is handed straight back to the app you were in (`gave_back`). +and the front is handed straight back to the app you were in - `gave_back` +says whether that worked. `set_value`, `drag`, `paste` and `move` do not carry the field yet. `computer_launch` joins them with `background: true`: the app starts behind diff --git a/docs/docs/capability-matrix/index.html b/docs/docs/capability-matrix/index.html index 5a709556..bd014bc0 100644 --- a/docs/docs/capability-matrix/index.html +++ b/docs/docs/capability-matrix/index.html @@ -221,7 +221,7 @@

Walls we clear partly, and say so

- + diff --git a/docs/index.html b/docs/index.html index bf272930..d267710b 100644 --- a/docs/index.html +++ b/docs/index.html @@ -751,7 +751,7 @@

Install in two minutes

Have your agent run computer_permissions. It tells you what is missing.

Want to look before it can touch? Start it with CMCP_MODE=readonly. No tool takes - your screen by default; CMCP_BACKGROUND=0 adds the seven that do. An app that pulls itself forward is handed back, and the reply says so. + your screen by default; CMCP_BACKGROUND=0 adds the seven that do. An app that pulls itself forward is handed back, and the reply says whether that worked. Guides: Claude Code, Codex, Cursor, Copilot, Claude Desktop, VS Code.

diff --git a/mcp-server/README.md b/mcp-server/README.md index 4db9f3e3..6e12ba9a 100644 --- a/mcp-server/README.md +++ b/mcp-server/README.md @@ -11,8 +11,9 @@ in the hours you are not watching. - **It does not take over your Mac.** It presses buttons and fills fields in windows that stay behind the one you are in, and it leaves your pointer where you put it. When an app pulls itself to the front as it opens, the front is - handed straight back and the reply says so - nothing is left stealing what you - are typing. + handed straight back and the reply says so. In one of 65 measured moments like + it (GitHub's Mac, many agents at once) it could not be, and the reply said that too (`gave_back: + false`): until you click back, what you type goes to that app. - **It does not pretend.** When something is refused or fails, it says so and says why. The most common complaint about agents driving a computer is that they carry on as if it worked. @@ -235,7 +236,8 @@ the same way - including when the call failed halfway, because a half-done write that took the screen must not be the one line that stays silent. `press` and `menu` carry it too: an app can bring itself forward in response (measured: File > New Finder Window did), and when it does, the answer says so -and the front is handed straight back to the app you were in (`gave_back`). +and the front is handed straight back to the app you were in - `gave_back` +says whether that worked. `set_value`, `drag`, `paste` and `move` do not carry the field yet. `computer_launch` joins them with `background: true`: the app starts behind From 3de50a51f5df91d56f6f22310cb679d0ee6aedc0 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Sun, 1 Nov 2026 04:58:41 +0100 Subject: [PATCH 12/94] ci: fremmed-mac - Script Editor lige foer mutationsporten (ikke foer giv-tilbage-mutanterne), trinfrist 30 min Panel R3 1/11 (Opus): giv-tilbage-mutanterne koerer foer baggrund-mus' baseline og efterlader Finder forrest; i suiten koerer giv-tilbage efter baggrund-mus (run-all.sh:134/140). Kommentaren om haenget rettet (Astra R3): mutationsbeviset blev sprunget over, og slutporten afviste koerslen. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/fremmed-mac.yml | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/.github/workflows/fremmed-mac.yml b/.github/workflows/fremmed-mac.yml index 134713b9..415c62d7 100644 --- a/.github/workflows/fremmed-mac.yml +++ b/.github/workflows/fremmed-mac.yml @@ -167,8 +167,9 @@ jobs: - name: Mange agenter samtidig id: par continue-on-error: true - # 1/11 (panel R2): et svar der aldrig kom, brændte 5,5 t af jobbets 6 (41077418047 forsøg 1) - porten naaede aldrig at skrive. - timeout-minutes: 60 + # 1/11 (panel R2-R3): parallelproeven hang til jobfristen (41077418047 forsoeg 1); mutationsbeviset blev sprunget + # over, og slutporten afviste koerslen. Et normalt trin tager ~4 min. + timeout-minutes: 30 run: | killall Chess Calculator Contacts "System Settings" "Activity Monitor" Notes Safari "Script Editor" 2>/dev/null || true CMCP_FILM="$RUNNER_TEMP/film" CMCP_PARALLEL_RAPPORT="$RUNNER_TEMP/parallel.json" node test/parallel.mjs @@ -225,10 +226,10 @@ jobs: # skal kunne blive roed. bash -e: uden «|| rc» stoppede trinnet ved foerste. run: | rc=0 - # 1/11 (panel R2): «Mange agenter» lukker Script Editor og TextEdit, saa Finder staar forrest her; i suiten - # (Script Editor forrest) bestaar baggrund-mus, i portens baseline ikke. Samme udgangspunkt som suiten. - open -a "Script Editor"; sleep 4 bash .github/mutant-giv-tilbage.sh || rc=1 + # 1/11 (panel R2-R3): «Mange agenter» og giv-tilbage-mutanterne efterlader Finder forrest; i suiten (Script Editor + # forrest) bestaar baggrund-mus' menu-tjek, i portens baseline ikke. Lige foer porten, saa baggrund-mus starter som i suiten. + open -a "Script Editor"; sleep 4 python3 .github/mutant-porte.py || rc=1 exit $rc From 605c70eb156b10fef3139fb6db4124c9195499fd Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Sun, 1 Nov 2026 04:58:41 +0100 Subject: [PATCH 13/94] 0.4.1: teksterne efter panel R3 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - «longest such moment» -> «longest one that was handed back» (det ikke-tilbagegivne varede mindst 40 s); elleve koersler hele vejen (32 af 33 niveauer, 4.939/4.939); haenget: aarsag ikke fundet; proeverne navngivet. - Kendte graenser i datid (porten er aendret) og «these menu checks», ikke hele proeven. - README/npm-README: give-back lader forgrunden staa efter klik, rul eller en tast som Shift inden for 1,5 s (Skaerm.swift menneskeRoerteNetop); launch-saetningen og matrixens launch-saetning melder gave_back. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 47 ++++++++++++++------------ README.md | 6 ++-- docs/docs/capability-matrix/index.html | 2 +- mcp-server/README.md | 6 ++-- 4 files changed, 34 insertions(+), 27 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index cbf58e7b..0d44e3d9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -23,34 +23,37 @@ bundle install from, had SDK 1.32.1 and five audit findings (zod, body-parser, resolution of this version's `package.json`; newer releases in range can appear after it. The SDK also has to be at least 1.32.1. -**Several agents at once.** In the test where 5, 10 and 15 agents work in the -background while another test types into TextEdit, an agent that opens a Finder -window brings Finder forward for a moment, twice at every level, and the front -is handed straight back - the longest such moment measured was 2.8 seconds. It -happened in all six completed runs on GitHub's Mac counted for this note, on -macOS 15.7 and 15.8 alike, and the recording on the front page shows the same -thing. In one of 65 such moments across eleven runs the front could not be -handed back: Finder stayed in front, and the reply said so (`gave_back: -false`). Under load an agent can also stop and wait when it cannot tell which -app the person is in - it then does nothing - and one run hung until GitHub's -time limit. None of this is fixed in this version. Every word the typing test sent into TextEdit was verified by the -helper (2,663 of 2,663); whether keys typed by hand during such a moment land in -Finder is not measured. The test used to blame whichever agent happened to -start during the moment - even one that only reads - and now judges it on -GitHub's Mac the way it already did on a person's own Mac. +**Several agents at once.** In `test/parallel.mjs`, 5, 10 and 15 agents work in +the background while another test types into TextEdit. An agent that opens a +Finder window brings Finder forward for a moment, and the front is handed +straight back - the longest one that was handed back lasted 2.8 seconds. In +eleven runs on GitHub's Mac, on macOS 15.7 and 15.8 alike, it happened twice at +32 of 33 levels; the recording on the front page shows the same thing. In one +of 65 such moments the front could not be handed back: Finder stayed in front +for the rest of that round (at least 40 seconds), and the reply said so +(`gave_back: false`). Under load an agent can also stop and wait when it cannot +tell which app the person is in - it then does nothing - and one run hung until +GitHub's time limit; the cause of the hang is not found. None of this is fixed +in this version. Every word the typing test sent into TextEdit was verified by +the helper (4,939 of 4,939 across the eleven runs); whether keys typed by hand +during such a moment land in Finder is not measured. The test used to blame +whichever agent happened to start during the moment - even one that only +reads - and now judges it on GitHub's Mac the way it already did on a person's +own Mac. **Tests.** `test/stille-vej.mjs` gives `scroll --app` a point, as 0.4.0's helper requires; on a foreign Mac that check had failed on 0.4.0. The mutation gate now prints the last lines of a test that fails before anything is mutated. `scripts/release.sh` looks for the CI run in the last 100 runs, not 20. -**Known limits found while measuring 0.4.1.** In the mutation gate on GitHub's -Mac, `test/baggrund-mus.mjs` runs after the many-agents test, with Finder in -front; there a menu opened by a click behind was not closed again -(`menu_closed: false` in the reply), though the same test passes in the suite. -Its 38 mutants are therefore not proven on a foreign Mac. The check that the -helper process ends within 500 ms of a stop failed in 3 of 11 runs (524-546 ms), -on 0.4.0 and 0.4.1 alike; the mouse button was released in all of them (F2). +**Known limits found while measuring 0.4.1.** Up to 1 November, the mutation +gate on GitHub's Mac ran `test/baggrund-mus.mjs` after the many-agents test, +with Finder in front, and there a menu opened by a click behind was not closed +again (`menu_closed: false` in the reply), though these menu checks pass in the +suite. Its 38 mutants were therefore not proven on a foreign Mac. In +`test/sikker-frigivelse.mjs`, the check that the helper process ends within +500 ms of a stop (F2b) failed in 3 of 11 runs (524-546 ms), on 0.4.0 and 0.4.1 +alike; the mouse button was released in all of them (F2). **Corrected.** The 0.2.1 notes below said "Password managers ask every single time, in every mode." In background mode they are refused, not asked; in the diff --git a/README.md b/README.md index 0b8400f6..91e7a0cc 100644 --- a/README.md +++ b/README.md @@ -15,7 +15,9 @@ in the hours you are not watching. you put it. When an app pulls itself to the front as it opens, the front is handed straight back and the reply says so. In one of 65 measured moments like it (GitHub's Mac, many agents at once) it could not be, and the reply said that too (`gave_back: - false`): until you click back, what you type goes to that app. + false`): until you click back, what you type goes to that app. It also leaves + the front alone when you clicked, scrolled or pressed a key such as Shift in + the last 1.5 seconds - that is taken to be you. - **It does not pretend.** When something is refused or fails, it says so and says why. The most common complaint about agents driving a computer is that they carry on as if it worked. @@ -245,7 +247,7 @@ says whether that worked. `computer_launch` joins them with `background: true`: the app starts behind what you are doing. Many apps bring themselves forward as they start - six of eight did on a clean Mac - and when one does, the front is handed straight back -and the answer says `took_screen` and `gave_back`. It is a moment, not nothing. Seven are still held back: +and the answer says `took_screen`, and in `gave_back` whether that worked. It is a moment, not nothing. Seven are still held back: `move`, `activate`, `quit`, `space`, `window`, `drag` and `paste` - until you lend the screen: `computer_request_screen` asks you in the box in the corner of your screen (and in the menu bar), one agent at a time, approved with Touch ID, for at diff --git a/docs/docs/capability-matrix/index.html b/docs/docs/capability-matrix/index.html index bd014bc0..4276e6de 100644 --- a/docs/docs/capability-matrix/index.html +++ b/docs/docs/capability-matrix/index.html @@ -221,7 +221,7 @@

Walls we clear partly, and say so

WallWhat actually happens
Redacting secretsmeasuredOnly what macOS marks as secure is painted out. Measured on a real web page: a password input carries role AXTextField with subrole AXSecureTextField and is redacted; a plain text field is not. A password in a text editor, or a token printed in a terminal, carries no marker and will not be hidden. Use readonly when the screen holds something the system cannot know about.
Working without taking over the screenmeasuredThree kinds, and the difference is how the action is delivered, not what the tool is called. Quiet by delivery: computer_press, computer_set_value and computer_menu fire the element's own accessibility action, so they work on a window behind the one you are in and never touch your pointer. The app can still bring itself forward in response - measured: File > New Finder Window did - and then press and menu answer took_screen and hand the front straight back. Quiet when you name the app: computer_click, computer_type, computer_key and computer_scroll are delivered into that app's own event queue - measured: the text arrived, the pointer stayed where it was left, and the front window did not change. computer_launch joins them with background: true - measured on a clean Mac, six of eight apps brought themselves forward as they started, and the front is handed straight back. Without an app they go through the system input tap and land wherever your keyboard focus is, so in background mode they are refused. One measured limit: keystrokes do not land in a Chromium window that is not focused, so for anything Chromium-based use computer_press and computer_set_value. Held back in background mode: computer_move, computer_drag, computer_paste, computer_activate, computer_quit, computer_space and computer_window. Each either moves your pointer, brings something to the front, or changes what you see - a window moved on a screen you are looking at is a quiet channel with a very visible result. computer_ask_user left this list on 29 September: in background mode its question waits in the menu bar icon instead of a dialog. And the held-back seven are no longer out of reach: computer_request_screen asks you to lend this one agent the screen, approved with Touch ID in the menu bar, for at most 15 minutes. While it has it, each step waits while you are using the keyboard or mouse (a step already running finishes), and one click in the menu takes the screen back and stops a step still running. Set CMCP_BACKGROUND and nothing can borrow it.
Working without taking over the screenmeasuredThree kinds, and the difference is how the action is delivered, not what the tool is called. Quiet by delivery: computer_press, computer_set_value and computer_menu fire the element's own accessibility action, so they work on a window behind the one you are in and never touch your pointer. The app can still bring itself forward in response - measured: File > New Finder Window did - and then press and menu answer took_screen and hand the front straight back - gave_back says whether that worked (once in 65 moments on GitHub’s Mac it did not). Quiet when you name the app: computer_click, computer_type, computer_key and computer_scroll are delivered into that app's own event queue - measured: the text arrived, the pointer stayed where it was left, and the front window did not change. computer_launch joins them with background: true - measured on a clean Mac, six of eight apps brought themselves forward as they started, and the front is handed straight back. Without an app they go through the system input tap and land wherever your keyboard focus is, so in background mode they are refused. One measured limit: keystrokes do not land in a Chromium window that is not focused, so for anything Chromium-based use computer_press and computer_set_value. Held back in background mode: computer_move, computer_drag, computer_paste, computer_activate, computer_quit, computer_space and computer_window. Each either moves your pointer, brings something to the front, or changes what you see - a window moved on a screen you are looking at is a quiet channel with a very visible result. computer_ask_user left this list on 29 September: in background mode its question waits in the menu bar icon instead of a dialog. And the held-back seven are no longer out of reach: computer_request_screen asks you to lend this one agent the screen, approved with Touch ID in the menu bar, for at most 15 minutes. While it has it, each step waits while you are using the keyboard or mouse (a step already running finishes), and one click in the menu takes the screen back and stops a step still running. Set CMCP_BACKGROUND and nothing can borrow it.
Several agents at oncemeasuredEach MCP client runs its own server. Measured: two servers, 50 interleaved writes, zero torn lines, and every line carries a session mark. Writes in the same app take turns: each holds a lock for that app, so keys and clicks never interleave within an action. Between actions they still share one pointer and one focused window; give background work to computer_press.
Knowing where the cursor ismeasuredcomputer_focused reports the focused element and whether it is secure. The system-wide lookup alone returns nothing - measured - so it goes through the focused application, then the frontmost app.
A Save / Don't Save sheetmeasuredThe sheet you meet every time you close something with unsaved work. Measured: the sheet is found as AXSheet, all three buttons come back with a center and a pressable flag, and computer_find with contains: "Don't Save" returns exactly that one button - an agent looks for the words, not for a position. It is also the clearest case for the gate: a sheet can throw away work on your behalf, so in read-only mode pressing it is refused and nothing reaches the machine. Measured against a sheet the test puts up itself, in a fully transparent window, so proving it costs nobody their screen.
- + diff --git a/mcp-server/README.md b/mcp-server/README.md index 6e12ba9a..a1f0479c 100644 --- a/mcp-server/README.md +++ b/mcp-server/README.md @@ -13,7 +13,9 @@ in the hours you are not watching. you put it. When an app pulls itself to the front as it opens, the front is handed straight back and the reply says so. In one of 65 measured moments like it (GitHub's Mac, many agents at once) it could not be, and the reply said that too (`gave_back: - false`): until you click back, what you type goes to that app. + false`): until you click back, what you type goes to that app. It also leaves + the front alone when you clicked, scrolled or pressed a key such as Shift in + the last 1.5 seconds - that is taken to be you. - **It does not pretend.** When something is refused or fails, it says so and says why. The most common complaint about agents driving a computer is that they carry on as if it worked. @@ -243,7 +245,7 @@ says whether that worked. `computer_launch` joins them with `background: true`: the app starts behind what you are doing. Many apps bring themselves forward as they start - six of eight did on a clean Mac - and when one does, the front is handed straight back -and the answer says `took_screen` and `gave_back`. It is a moment, not nothing. Seven are still held back: +and the answer says `took_screen`, and in `gave_back` whether that worked. It is a moment, not nothing. Seven are still held back: `move`, `activate`, `quit`, `space`, `window`, `drag` and `paste` - until you lend the screen: `computer_request_screen` asks you in the box in the corner of your screen (and in the menu bar), one agent at a time, approved with Touch ID, for at From 83983f6830c5f67ffe8246309f5799d97910352f Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Sun, 1 Nov 2026 05:05:26 +0100 Subject: [PATCH 14/94] 0.4.1: panel R4's to valgfri praeciseringer (modifier key, completed runs) - begge GODKENDT b og c Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 2 +- README.md | 4 ++-- mcp-server/README.md | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0d44e3d9..0b830952 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -27,7 +27,7 @@ appear after it. The SDK also has to be at least 1.32.1. the background while another test types into TextEdit. An agent that opens a Finder window brings Finder forward for a moment, and the front is handed straight back - the longest one that was handed back lasted 2.8 seconds. In -eleven runs on GitHub's Mac, on macOS 15.7 and 15.8 alike, it happened twice at +eleven completed runs on GitHub's Mac, on macOS 15.7 and 15.8 alike, it happened twice at 32 of 33 levels; the recording on the front page shows the same thing. In one of 65 such moments the front could not be handed back: Finder stayed in front for the rest of that round (at least 40 seconds), and the reply said so diff --git a/README.md b/README.md index 91e7a0cc..3bee9215 100644 --- a/README.md +++ b/README.md @@ -16,8 +16,8 @@ in the hours you are not watching. handed straight back and the reply says so. In one of 65 measured moments like it (GitHub's Mac, many agents at once) it could not be, and the reply said that too (`gave_back: false`): until you click back, what you type goes to that app. It also leaves - the front alone when you clicked, scrolled or pressed a key such as Shift in - the last 1.5 seconds - that is taken to be you. + the front alone when you clicked, scrolled or pressed a modifier key such as + Shift in the last 1.5 seconds - that is taken to be you. - **It does not pretend.** When something is refused or fails, it says so and says why. The most common complaint about agents driving a computer is that they carry on as if it worked. diff --git a/mcp-server/README.md b/mcp-server/README.md index a1f0479c..94d89db2 100644 --- a/mcp-server/README.md +++ b/mcp-server/README.md @@ -14,8 +14,8 @@ in the hours you are not watching. handed straight back and the reply says so. In one of 65 measured moments like it (GitHub's Mac, many agents at once) it could not be, and the reply said that too (`gave_back: false`): until you click back, what you type goes to that app. It also leaves - the front alone when you clicked, scrolled or pressed a key such as Shift in - the last 1.5 seconds - that is taken to be you. + the front alone when you clicked, scrolled or pressed a modifier key such as + Shift in the last 1.5 seconds - that is taken to be you. - **It does not pretend.** When something is refused or fails, it says so and says why. The most common complaint about agents driving a computer is that they carry on as if it worked. From 0178a669feaf3ec8dad1f8273ee67e9c01be5db1 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Sun, 1 Nov 2026 11:25:38 +0100 Subject: [PATCH 15/94] 0.4.1: baggrund-mus-hypotesen falsificeret - aarsag ikke fundet; Script Editor-linjen fjernet; rettelse af 0.4.0's menu-loefte MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fremmed Mac 41270352704 (1003f89): portens baseline havde Script Editor forrest (5c «Script Editor -> Script Editor») og 5a/5b/5g fejlede alligevel. «Finder forrest» var ikke aarsagen (panel R2 B). Linjen gjorde ingen forskel og er fjernet. CHANGELOG: kendt graense uden aarsag, F2b 4 af 12 (517-546 ms, F2 uden DUMP), Corrected-note til «A click behind never leaves a menu over your work». Co-Authored-By: Claude Opus 5.5 --- .github/workflows/fremmed-mac.yml | 3 --- CHANGELOG.md | 17 ++++++++++------- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/fremmed-mac.yml b/.github/workflows/fremmed-mac.yml index 415c62d7..5aa45490 100644 --- a/.github/workflows/fremmed-mac.yml +++ b/.github/workflows/fremmed-mac.yml @@ -227,9 +227,6 @@ jobs: run: | rc=0 bash .github/mutant-giv-tilbage.sh || rc=1 - # 1/11 (panel R2-R3): «Mange agenter» og giv-tilbage-mutanterne efterlader Finder forrest; i suiten (Script Editor - # forrest) bestaar baggrund-mus' menu-tjek, i portens baseline ikke. Lige foer porten, saa baggrund-mus starter som i suiten. - open -a "Script Editor"; sleep 4 python3 .github/mutant-porte.py || rc=1 exit $rc diff --git a/CHANGELOG.md b/CHANGELOG.md index 0b830952..1eb07596 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -48,16 +48,19 @@ prints the last lines of a test that fails before anything is mutated. **Known limits found while measuring 0.4.1.** Up to 1 November, the mutation gate on GitHub's Mac ran `test/baggrund-mus.mjs` after the many-agents test, -with Finder in front, and there a menu opened by a click behind was not closed -again (`menu_closed: false` in the reply), though these menu checks pass in the -suite. Its 38 mutants were therefore not proven on a foreign Mac. In -`test/sikker-frigivelse.mjs`, the check that the helper process ends within -500 ms of a stop (F2b) failed in 3 of 11 runs (524-546 ms), on 0.4.0 and 0.4.1 -alike; the mouse button was released in all of them (F2). +and there a menu opened by a click behind was not closed again (`menu_closed: +false` in the reply) - with Finder in front, and in a run that started Script +Editor first, with Script Editor in front - though these menu checks pass in +the suite. The cause is not found. Its 38 mutants were therefore not proven on +a foreign Mac. In `test/sikker-frigivelse.mjs`, the check that the helper +process ends within 500 ms of a stop (F2b) failed in 4 of 12 runs (517-546 ms), +on 0.4.0 and 0.4.1 alike; the mouse button was released in all of them (F2). **Corrected.** The 0.2.1 notes below said "Password managers ask every single time, in every mode." In background mode they are refused, not asked; in the -foreground they ask every time. +foreground they ask every time. The 0.4.0 notes say "A click behind never leaves +a menu over your work." In the mutation gate on GitHub's Mac a menu opened by a +click behind was left open, and the reply said so (`menu_closed: false`). ## 0.4.0 (in progress) From f6b4348fe1457d0050eea5abcb3d4df4924e5b6f Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Sun, 1 Nov 2026 11:37:05 +0100 Subject: [PATCH 16/94] 0.4.1: kendt graense efter 605c70e - Script Editor forrest ogsaa lige foer porten (2. falsifikation), F2b 4 af 13, nutid Fremmed Mac 41271247500 (605c70e): suiten groen, mange agenter groen; portens baseline for baggrund-mus stadig roed med Script Editor forrest (2c/5c). Placeringen betyder intet; linjens fjernelse i 0178a66 staar. Tal genoptalt fra 13 logs. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1eb07596..36f5abb9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -46,15 +46,16 @@ requires; on a foreign Mac that check had failed on 0.4.0. The mutation gate now prints the last lines of a test that fails before anything is mutated. `scripts/release.sh` looks for the CI run in the last 100 runs, not 20. -**Known limits found while measuring 0.4.1.** Up to 1 November, the mutation -gate on GitHub's Mac ran `test/baggrund-mus.mjs` after the many-agents test, -and there a menu opened by a click behind was not closed again (`menu_closed: -false` in the reply) - with Finder in front, and in a run that started Script -Editor first, with Script Editor in front - though these menu checks pass in -the suite. The cause is not found. Its 38 mutants were therefore not proven on -a foreign Mac. In `test/sikker-frigivelse.mjs`, the check that the helper -process ends within 500 ms of a stop (F2b) failed in 4 of 12 runs (517-546 ms), -on 0.4.0 and 0.4.1 alike; the mouse button was released in all of them (F2). +**Known limits found while measuring 0.4.1.** The mutation gate on GitHub's Mac +runs `test/baggrund-mus.mjs` after the many-agents test, and there a menu +opened by a click behind is not closed again (`menu_closed: false` in the +reply) - with Finder in front, and in two runs that put Script Editor in front +first, with Script Editor in front - though these menu checks pass in the +suite. The cause is not found. Its 38 mutants are therefore not proven on a +foreign Mac. In `test/sikker-frigivelse.mjs`, the check that the helper process +ends within 500 ms of a stop (F2b) failed in 4 of 13 completed runs by +1 November (517-546 ms), on 0.4.0 and 0.4.1 alike; the mouse button was +released in all of them (F2). **Corrected.** The 0.2.1 notes below said "Password managers ask every single time, in every mode." In background mode they are refused, not asked; in the From d24a55daf9a5cd07d5639a5b7b47ec67bf7c0c2b Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Mon, 2 Nov 2026 01:42:48 +0100 Subject: [PATCH 17/94] Skaermlaan uden spoergsmaal (CMCP_SCREEN_ASK=0): serveren beder ikonet give laanet straks MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Gustav 2/11: computer-mcp skal tage skaermen uden at spoerge, naar den skal. Med CMCP_SCREEN_ASK=0 sender serveren ask:false, og et «standing»-svar fra ikonet giver laanet. Uden kontakten er «standing» et nej. Laanet er ellers det samme: hvert skridt venter mens mennesket bruger tastatur eller mus. Proeve 14 i skaerm-laan.mjs (4 varianter, 14 tjek). Co-Authored-By: Claude Opus 5.5 --- mcp-server/godkend.js | 14 ++++++++++++-- mcp-server/index.js | 8 +++++--- mcp-server/policy.js | 12 ++++++++++++ test/skaerm-laan.mjs | 41 +++++++++++++++++++++++++++++++++++++++++ 4 files changed, 70 insertions(+), 5 deletions(-) diff --git a/mcp-server/godkend.js b/mcp-server/godkend.js index 80da6552..5dc9af51 100644 --- a/mcp-server/godkend.js +++ b/mcp-server/godkend.js @@ -174,7 +174,7 @@ export async function spoergOmGoerSelv(sp, timeoutSec) { /// ingen fil en agent kan pille ved, og intet der skal spoerges om igen. /// Svarer { ok, grund, til, afslut } - `til` er det tidligste af vores og /// ikonets ur; `afslut` giver skaermen tilbage foer tid. -export async function laanSkaermen({ session, client, text, minutter }, timeoutSec, slut) { +export async function laanSkaermen({ session, client, text, minutter, spoerg = true }, timeoutSec, slut) { // ⛔ R42 (Astra, MAALT): et afbrudt kald fik alligevel laanet, da mennesket sagde ja bagefter. if (kaldAfbrudt()) return { ok: false, grund: afbrudtGrund('nobody was asked') }; if (venter) return { ok: false, grund: 'this agent already has a question waiting in the menu bar' }; @@ -206,7 +206,10 @@ export async function laanSkaermen({ session, client, text, minutter }, timeoutS sock.write(JSON.stringify({ nonce, session, client: ren(client).slice(0, 200), text: helTekst, scope: `If you allow it, the agent may use your screen for ${minutter} minutes: move the pointer, type into the app in front and bring windows forward. Before each step it waits if you are using the keyboard or mouse; a step already running finishes, or stops at once when you take the screen back. Password apps, deletions, and messages in the apps and web chats it recognises still ask. Take the screen back at any time with Take the screen back now, in the box in the corner of your screen or in this menu.`, - target: 'your screen', kind: 'screen', minutes: minutter, expires: frist + target: 'your screen', kind: 'screen', minutes: minutter, expires: frist, + // 2/11: kun naar mennesket har slaaet spoergsmaalet fra (CMCP_SCREEN_ASK=0). Et ikon der ikke kender feltet, + // spoerger som foer - og svarer «owner», som ogsaa godtages. + ...(spoerg ? {} : { ask: false }) }) + '\n'); }); sock.on('data', (d) => { @@ -221,6 +224,13 @@ export async function laanSkaermen({ session, client, text, minutter }, timeoutS const til = Math.min(vores, Number(m.until) > 0 ? Number(m.until) : vores); return afgoer({ ok: true, til, afslut: () => sock.destroy(), grund: 'the person gave this agent the screen and confirmed it was them' }); } + // 2/11: «standing» = ikonet gav laanet uden et spoergsmaal. Godtages KUN naar denne server selv bad om det + // (CMCP_SCREEN_ASK=0) - ellers er det et svar paa noget ingen har slaaet til, og det er et nej. + if (m.ok === true && m.verified === 'standing' && !spoerg) { + const vores = Date.now() + minutter * 60_000; + const til = Math.min(vores, Number(m.until) > 0 ? Number(m.until) : vores); + return afgoer({ ok: true, til, afslut: () => sock.destroy(), grund: 'the person has set this Mac to lend the screen without asking (CMCP_SCREEN_ASK=0)' }); + } if (m.verified === 'optaget') { afgoer({ ok: false, grund: 'another agent has the screen right now' }); return sock.destroy(); } if (m.ok === false) pauseTil = Date.now() + PAUSE_MS; afgoer({ ok: false, grund: m.ok === false ? 'the person said no in the menu bar' : 'the answer was not confirmed by the person (Touch ID or password)' }); diff --git a/mcp-server/index.js b/mcp-server/index.js index 6ace6e82..0fb70eb7 100644 --- a/mcp-server/index.js +++ b/mcp-server/index.js @@ -25,7 +25,7 @@ import { fileURLToPath } from 'url'; import { TOOLS, TOOL_BY_NAME, describe } from './tools.js'; import { spoergOmGoerSelv, laanSkaermen, tagMaaling, iHandling, handlingVenterStadig, kaldAfbrudt, restMs, stopAlleKald, kaldStoppet, afbrudtGrund } from './godkend.js'; import { BESKED_APPS, beskedSlags, WEBMAIL, WEBCHAT, SENDE_ORD, tastSender, saetLaan, laanAktivt, laanTilTid, baggrundLaast, laanOejeblik } from './policy.js'; -import { TIER, ALWAYS_ASK_APPS, SPOERG_PR_SESSION, decide, currentMode, askHumanToDo, askTimeout, skaermVentetid, menuSerFarlig, tastSerFarlig, baggrund, TAGER_SKAERMEN, KAN_STILLES, MANGLER_FOR_STILLE, kaldErStille, tagerSkaermen, resetSession, glemSessionsProgrammer, isSessionGranted, sessionsProgrammer } from './policy.js'; +import { TIER, ALWAYS_ASK_APPS, SPOERG_PR_SESSION, decide, currentMode, askHumanToDo, askTimeout, skaermVentetid, skaermUdenSpoergsmaal, menuSerFarlig, tastSerFarlig, baggrund, TAGER_SKAERMEN, KAN_STILLES, MANGLER_FOR_STILLE, kaldErStille, tagerSkaermen, resetSession, glemSessionsProgrammer, isSessionGranted, sessionsProgrammer } from './policy.js'; import { callHelper, HelperError, helperPath, frontmostBundleId, resolveBundleId, resolveApp, resolveAppStrict, afbrydSkaermKald } from './helper.js'; import { record, scrubArgs, kendNoegler, fingerprint, AUDIT_PATH, noterVentende, ventende, KOE_PATH, kaedenHolder, SESSION, loggenKanSkrives, iKald } from './audit.js'; import { medProgramLaas } from './programlaas.js'; @@ -443,7 +443,9 @@ async function skaermLaan(args) { // slut ugyldigt, og laanet sluttede aldrig. Nu faar kun et ja et nummer. let nr = null, lukketFoerStart = false; const min = Math.max(1, Math.min(15, Number.isInteger(args.minutes) ? args.minutes : 10)); - const svar = await laanSkaermen({ session: SESSION, client: klientNavn(), text: laanTekst, minutter: min }, + // 2/11: CMCP_SCREEN_ASK=0 - ikonet giver laanet uden at spoerge (se skaermUdenSpoergsmaal i policy.js). + const spoerg = !skaermUdenSpoergsmaal(); + const svar = await laanSkaermen({ session: SESSION, client: klientNavn(), text: laanTekst, minutter: min, spoerg }, skaermVentetid(), async () => { // Forbindelsen er lukket: tiden gik, mennesket tog skaermen, ikonet doede, // eller agenten gav den tilbage. Kun DETTE laans slut taeller. @@ -464,7 +466,7 @@ async function skaermLaan(args) { if (kaldStoppet()) return errorResult('Stopped: the person pressed «Stop all agents now», so the screen was handed straight back. Ask them in the chat what they want before you continue.'); return errorResult('Cancelled: the client cancelled this call, so the screen was handed straight back.'); } - log(svar.ok ? 'allowed' : 'denied', svar.grund, true); + log(svar.ok ? 'allowed' : 'denied', svar.grund, spoerg); // R45 (Opus F): et stop under ventetiden er ikke et nej - «use the quiet tools» ville bede agenten fortsaette. if (!svar.ok && kaldStoppet()) return errorResult(`Stopped: ${svar.grund}. Ask them in the chat what they want before you continue.`); if (!svar.ok) { diff --git a/mcp-server/policy.js b/mcp-server/policy.js index 788b3572..05210d6a 100644 --- a/mcp-server/policy.js +++ b/mcp-server/policy.js @@ -412,6 +412,18 @@ export function askTimeout() { /// laengere vindue: 5 minutter som standard, 20 minutter som loft (under /// stdio-graensen paa 30 min for lange MCP-kald i Claude Code - saa kaldet /// aldrig selv afbrydes af klienten mens det venter). +/// ⛔ 2/11 (Gustav: «fjern det der med, at den skal spoerge om lov til at faa adgang til skaermen. Det skal den bare +/// goere, blive ved med, indtil den har det, hvis det endelig skal»): CMCP_SCREEN_ASK=0 beder ikonet give laanet +/// STRAKS, uden boks og uden Touch ID. Alt andet ved laanet er det samme: én agent ad gangen (ikonets koe), hvert +/// skridt venter mens mennesket bruger tastatur eller mus, og Esc / ⌃⌥⌘. / «Take the screen back now» tager den +/// tilbage. Kun de ord der siger nej, slaar spoergsmaalet fra - en tastefejl beholder det (samme regel som +/// CMCP_BACKGROUND). Giver det en agent ny magt? Nej: den der kan saette variablen, kan ogsaa saette +/// CMCP_BACKGROUND=0, som giver forgrunden helt uden laan - og uden at vente paa mennesket. +export function skaermUdenSpoergsmaal() { + const v = String(process.env.CMCP_SCREEN_ASK ?? '').trim().toLowerCase(); + return ['0', 'false', 'no', 'off', 'nej', 'fra'].includes(v); +} + export function skaermVentetid() { const v = Number(process.env.CMCP_SCREEN_WAIT); const sek = Number.isFinite(v) && v > 0 ? v : 300; diff --git a/test/skaerm-laan.mjs b/test/skaerm-laan.mjs index 84ca0b3b..e27c2a0a 100644 --- a/test/skaerm-laan.mjs +++ b/test/skaerm-laan.mjs @@ -61,6 +61,9 @@ function lavIkon(state) { } else if (ikon.svar === 'langsom') { // svarer ja efter 800 ms setTimeout(() => { try { sock.write(JSON.stringify({ nonce: q.nonce, ok: true, verified: 'owner', until: Date.now() + ikon.laanMs }) + '\n'); } catch {} }, 800); ikon.laan = sock; sock.on('end', () => { ikon.lukketAfServer++; }); + } else if (ikon.svar === 'staaende') { // 2/11: mennesket har slaaet spoergsmaalet fra - ikonet giver straks + sock.write(JSON.stringify({ nonce: q.nonce, ok: true, verified: 'standing', until: Date.now() + ikon.laanMs }) + '\n'); + ikon.laan = sock; sock.on('end', () => { ikon.lukketAfServer++; }); } else if (ikon.svar === 'ja') { sock.write(JSON.stringify({ nonce: q.nonce, ok: true, verified: 'owner', until: Date.now() + ikon.laanMs }) + '\n'); ikon.laan = sock; // forbindelsen holdes AABEN: den er laanet @@ -418,5 +421,43 @@ try { /"granted":\s*true/.test(r.tekst) && (Date.now() - foerAnden) > 700, `${Date.now() - foerAnden} ms · ${r.tekst.slice(0, 80)}`); } finally { K1.srv.kill(); K2.srv.kill(); } +// 14. ⛔ 2/11 (Gustav: «fjern det der med, at den skal spoerge om lov til at faa adgang til skaermen. Det skal den bare +// goere, blive ved med, indtil den har det»): med CMCP_SCREEN_ASK=0 beder serveren ikonet om laanet UDEN et +// spoergsmaal (ask:false), og ikonet giver det straks - stadig én agent ad gangen, og hvert skridt venter stadig, +// mens mennesket bruger tastatur eller mus. Uden kontakten maa et «standing»-svar ALDRIG give skaermen: et ikon +// (eller noget andet paa soklen), der svarer uden at mennesket har slaaet spoergsmaalet fra, faar et nej. +const laanLog = (st) => { try { return readFileSync(join(st, 'audit.jsonl'), 'utf8').trim().split('\n').map(x => JSON.parse(x)).filter(x => x.tool === 'computer_request_screen' && x.decision); } catch { return []; } }; +for (const [navn, ekstra, uden] of [['uden kontakten', {}, false], ['tastefejl «maybe»', { CMCP_SCREEN_ASK: 'maybe' }, false], ['CMCP_SCREEN_ASK=0', { CMCP_SCREEN_ASK: '0' }, true], ['CMCP_SCREEN_ASK=nej', { CMCP_SCREEN_ASK: 'nej' }, true]]) { + const st = mkdtempSync(join(tmpdir(), 'cmcp-laan-uden-')); + const ik = await lavIkon(st); + ik.svar = 'staaende'; + const A = server(st, HJ, ekstra); + try { + await A.klar(); + saet({ idle: { idle: 30 } }); + const r = await A.kald('computer_request_screen', { action: 'request', reason: 'upload seven images', minutes: 3 }); + const q = ik.spurgt.at(-1); + if (!uden) { + check(`14 ${navn}: ikonet bedes SPOERGE (ask ikke false)`, q && q.ask !== false, JSON.stringify(q || {}).slice(0, 120)); + check(`14 ${navn}: et «standing»-svar giver IKKE skaermen`, r.fejl && !(await A.navne()).includes('computer_move'), r.tekst.slice(0, 100)); + } else { + check(`14 ${navn}: ikonet bedes give laanet uden spoergsmaal (ask:false)`, q?.ask === false && q?.kind === 'screen', JSON.stringify(q || {}).slice(0, 120)); + check(`14 ${navn}: laanet givet straks`, !r.fejl && /"granted":\s*true/.test(r.tekst), r.tekst.slice(0, 100)); + const linje = laanLog(st).at(-1); + check(`14 ${navn}: loggen siger «givet uden at spoerge», ikke at mennesket bekraeftede`, + linje?.decision === 'allowed' && linje?.asked === false && /without asking/.test(linje?.reason || '') && !/confirmed it was them/.test(linje?.reason || ''), JSON.stringify(linje || {}).slice(0, 200)); + const f0 = HJ.handlingerNaaedeFrem().filter(k => k.argv[0] === 'move').length; + const m1 = await A.kald('computer_move', { x: 5, y: 5 }); + check(`14 ${navn}: ingen menneske-input - move udfoeres`, !m1.fejl && HJ.handlingerNaaedeFrem().filter(k => k.argv[0] === 'move').length === f0 + 1, m1.tekst.slice(0, 80)); + await vent(700); + saet({ idle: { idle: 0.1 } }); + const m2 = await A.kald('computer_move', { x: 6, y: 6 }); + check(`14 ${navn}: mennesket bruger musen - agenten VENTER stadig, intet flyttes`, + m2.fejl && /using the keyboard or mouse/.test(m2.tekst) && HJ.handlingerNaaedeFrem().filter(k => k.argv[0] === 'move').length === f0 + 1, m2.tekst.slice(0, 100)); + saet({ idle: { idle: 30 } }); + } + } finally { A.srv.kill(); } +} + console.log(fails.length ? `DUMPET: ${fails.length} tjek` : 'Alle tjek bestået.'); process.exit(fails.length ? 1 : 0); From 02800f53071ce0d84aea811647cf663d4f6fb53d Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Mon, 2 Nov 2026 01:51:51 +0100 Subject: [PATCH 18/94] Ikonet giver skaermlaanet uden spoergsmaal, naar serveren beder om det (ask:false) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit giverUdenSpoergsmaal (Tekst.swift): kun et skaerm-laan, kun ask:false, kun naar ingen anden agent har skaermen, og ikke i 120 s efter at mennesket tog den tilbage eller stoppede alle. Svaret hedder «standing», ikke «owner». Intet banner og ingen lyd for et laan uden spoergsmaal. Proeve 3f i ikon-menu.mjs. Co-Authored-By: Claude Opus 5.5 --- helper/Sources/cmcp-status/Tekst.swift | 9 +++++ helper/Sources/cmcp-status/main.swift | 56 ++++++++++++++++++++++++-- test/ikon-menu.mjs | 13 ++++++ 3 files changed, 75 insertions(+), 3 deletions(-) diff --git a/helper/Sources/cmcp-status/Tekst.swift b/helper/Sources/cmcp-status/Tekst.swift index cf80437d..283f8418 100644 --- a/helper/Sources/cmcp-status/Tekst.swift +++ b/helper/Sources/cmcp-status/Tekst.swift @@ -171,6 +171,15 @@ enum TouchIdUdfald: Equatable { case laan, svar(Bool) } /// overlevede proeven). func touchIdUdfald(ok: Bool, erLaan: Bool) -> TouchIdUdfald { ok && erLaan ? .laan : .svar(ok) } +/// 2/11: gives denne anmodning skaermen STRAKS uden spoergsmaal? Kun et skaerm-laan, kun naar serveren bad om det +/// (ask == false - nil og true spoerger), kun naar ingen anden agent har skaermen, og ikke mens spaerringen efter +/// menneskets «tag tilbage» / «stop alle» staar. Bor her, saa proeven (--dump-question) maaler den samme regel. +func giverUdenSpoergsmaal(kind: String?, ask: Bool?, andetLaanAktivt: Bool, spaerretTil: Date?, nu: Date = Date()) -> Bool { + guard kind == "screen", ask == false, !andetLaanAktivt else { return false } + if let t = spaerretTil, t > nu { return false } + return true +} + enum BoksHandling: Equatable { case foelg, tagTilbage, stopAlle, tillad(String), afvis(String), gjort(String), hentFrem(String), intet } /// Hvad et tryk paa en boksknap betyder. Knappen baerer sit eget spoergsmaal (`knapNonce`); diff --git a/helper/Sources/cmcp-status/main.swift b/helper/Sources/cmcp-status/main.swift index a074ceb2..883df62c 100644 --- a/helper/Sources/cmcp-status/main.swift +++ b/helper/Sources/cmcp-status/main.swift @@ -140,6 +140,9 @@ struct Spoergsmaal: Codable { let targetBundle: String? /// «skaerm»: hvor mange minutter skaermen laanes ud (hoejst 15). let minutes: Int? + /// 2/11: false = serveren koerer med CMCP_SCREEN_ASK=0 - laanet gives uden spoergsmaal (givStaaendeLaan). + /// nil (aeldre servere) og true spoerger som foer. + let ask: Bool? } final class Anmodning { @@ -167,10 +170,10 @@ final class Anmodning { /// ⛔ SKAERM-LAANET (29/9): ja'et skrives, men forbindelsen holdes AABEN. /// Laanet ER forbindelsen - naar den lukkes, er skaermen menneskets igen. - func svarLaan(til: Double) { + func svarLaan(til: Double, verified: String = "owner") { guard !besvaret, !lukket else { return } besvaret = true - let linje = "{\"nonce\":\"\(s.nonce)\",\"ok\":true,\"verified\":\"owner\",\"until\":\(Int(til))}\n" + let linje = "{\"nonce\":\"\(s.nonce)\",\"ok\":true,\"verified\":\"\(verified)\",\"until\":\(Int(til))}\n" linje.withCString { p in _ = write(fd, p, strlen(p)) } } // R53 (Opus): et fd der allerede er lukket, kan vaere genbrugt af en anden forbindelse - roer det ikke. @@ -180,6 +183,10 @@ final class Anmodning { /// Hoejst ét laan ad gangen: skaermen er én. var aktivtLaan: Anmodning? var laanTil: Date? +/// 2/11: tog mennesket skaermen tilbage (eller stoppede alle), gives intet laan UDEN spoergsmaal foer dette tidspunkt - +/// ellers fik den naeste agent i koeen skaermen i samme oejeblik, som mennesket tog den. +var staaendeSpaerretTil: Date? +let STAAENDE_PAUSE: Double = 120 var laanOpdateret: () -> Void = {} /// S2b-2/R53: blev ⌃⌥⌘. registreret? (saettes ved start; menuen viser kun genvejen, hvis den virker) var genvejeVirker: () -> Bool = { false } @@ -568,6 +575,14 @@ if CommandLine.arguments.contains("--dump-question") { return ["title": b.titel, "orange": b.orange, "lines": b.linjer, "buttons": b.knapper] }()] if let v = m.ventetekst { ud["waitingForLoan"] = v } + // 2/11: ville ikonet give dette laan uden spoergsmaal lige nu? Proeve-kun felt: {"simulateTakenBackSecondsAgo": N} + // simulerer menneskets «tag tilbage» for N sekunder siden (spaerringen er STAAENDE_PAUSE sekunder). + var spaerret: Date? = nil + if let raw = try? JSONSerialization.jsonObject(with: raa) as? [String: Any], + let siden = (raw["simulateTakenBackSecondsAgo"] as? Double) ?? (raw["simulateTakenBackSecondsAgo"] as? Int).map(Double.init) { + spaerret = Date().addingTimeInterval(STAAENDE_PAUSE - siden) + } + ud["lendsWithoutAsking"] = giverUdenSpoergsmaal(kind: s.kind, ask: s.ask, andetLaanAktivt: aktivtAndetLaan != nil, spaerretTil: spaerret) if s.kind == "screen" { let minutter = max(1, min(15, s.minutes ?? 10)) ud["whileLent"] = laanLinjer(klient: s.client, til: Date().addingTimeInterval(Double(minutter) * 60)) @@ -1062,6 +1077,7 @@ final class Ikon: NSObject, NSMenuDelegate, UNUserNotificationCenterDelegate { let post = "{\"ts\":\(Int(Date().timeIntervalSince1970 * 1000)),\"source\":\"\(kilde)\"}\n" // R45 (Opus G): en fejlet skrivning maa ikke vaere tavs - lyd + note; laanet gives tilbage uanset. do { try post.write(toFile: sti, atomically: true, encoding: .utf8) } catch { NSSound.beep(); noterKilde("stop-all-write-failed") } + spaerStaaende() aktivtLaan?.afslutLaan() tik() } @@ -1069,10 +1085,42 @@ final class Ikon: NSObject, NSMenuDelegate, UNUserNotificationCenterDelegate { /// Menuens og boksens stopknap: samme vej, hvert sit kildemaerke (R22). func tagTilbageNu(kilde: String) { noterKilde(kilde) + spaerStaaende() aktivtLaan?.afslutLaan() tik() } + /// 2/11: efter et «tag tilbage» / «stop alle» faar ingen agent skaermen uden spoergsmaal i STAAENDE_PAUSE sekunder. + /// Saettes FOER laanet lukkes: lukningen kalder laanOpdateret -> givStaaendeLaan, som saa ser spaerringen. + func spaerStaaende() { + staaendeSpaerretTil = Date().addingTimeInterval(STAAENDE_PAUSE) + DispatchQueue.main.asyncAfter(deadline: .now() + STAAENDE_PAUSE + 0.5) { [weak self] in self?.givStaaendeLaan() } + } + + /// ⛔ 2/11 (Gustav: «fjern det der med, at den skal spoerge om lov til at faa adgang til skaermen. Det skal den bare + /// goere, blive ved med, indtil den har det»): en skaerm-anmodning med ask:false (serverens CMCP_SCREEN_ASK=0) + /// gives STRAKS - ingen boks, intet Touch ID - naar ingen anden agent har skaermen, og ikke i to minutter efter + /// at mennesket tog den tilbage. Ellers venter den i koeen og gives, naar laanet foran slutter. Resten er det + /// samme laan: én agent ad gangen, serveren venter paa menneskets pauser, Esc / ⌃⌥⌘. / «Take the screen back + /// now» tager den tilbage. Svaret siger «standing», ikke «owner»: ingen bekraeftede noget i dette oejeblik. + func givStaaendeLaan() { + let andetAktivt = aktivtLaan.map { !$0.lukket } ?? false + guard let a = anmodninger.first(where: { !$0.besvaret && !$0.lukket + && giverUdenSpoergsmaal(kind: $0.s.kind, ask: $0.s.ask, andetLaanAktivt: andetAktivt, spaerretTil: staaendeSpaerretTil) }) + else { return } + let minutter = max(1, min(15, a.s.minutes ?? 10)) + let til = Date().addingTimeInterval(Double(minutter) * 60) + a.svarLaan(til: til.timeIntervalSince1970 * 1000, verified: "standing") + anmodninger.removeAll { $0 === a } + if a.lukket { tik(); return } + aktivtLaan = a; laanTil = til + laanOpdateret() // S2b-2: Esc bliver stoptast, saa laenge laanet varer + DispatchQueue.main.asyncAfter(deadline: .now() + Double(minutter) * 60) { + if aktivtLaan === a { a.afslutLaan() } + } + tik() + } + /// «Done» paa et goer-selv-spoergsmaal: et signal, ikke et samtykke. @objc func gjort(_ sender: NSMenuItem) { gjortNonce(sender.representedObject as? String, kilde: "done") } @@ -1135,6 +1183,8 @@ final class Ikon: NSObject, NSMenuDelegate, UNUserNotificationCenterDelegate { var lydHukommelse = LydHukommelse() func vis(_ a: Anmodning) { + // 2/11: et laan uden spoergsmaal er ikke et spoergsmaal - ingen lyd, intet banner. Gives straks, eller venter i koeen. + if a.s.kind == "screen" && a.s.ask == false { givStaaendeLaan(); tik(); return } tik() if lydHukommelse.skalLyde(nonce: a.s.nonce, lukket: a.lukket, besvaret: a.besvaret, til: lydSlaaetTil()) { NSSound(named: "Glass")?.play() @@ -1220,5 +1270,5 @@ if !genveje.stopRegistreret { ikon.noterKilde("stop-all-hotkey-unavailable") } genveje.vedStop = { ikon.stopAlleNu(kilde: "stop-all-hotkey") } genveje.vedEsc = { ikon.stopAlleNu(kilde: "stop-all-esc-loan") } nyAnmodning = { a in ikon.vis(a) } -laanOpdateret = { genveje.laan(aktivtLaan.map { !$0.lukket } ?? false); ikon.tik() } +laanOpdateret = { genveje.laan(aktivtLaan.map { !$0.lukket } ?? false); ikon.tik(); ikon.givStaaendeLaan() } app.run() diff --git a/test/ikon-menu.mjs b/test/ikon-menu.mjs index 48f15a5a..26b27633 100644 --- a/test/ikon-menu.mjs +++ b/test/ikon-menu.mjs @@ -75,6 +75,19 @@ check('3d ...og en Waiting-linje siger hvem og hvor laenge', const q2 = vis({ text: 'Use your screen for 3 minutes: resize a window', kind: 'screen', minutes: 3 }); check('3e uden koe: Allow staar, ingen waitingForLoan-noegle', q2.buttons[0] === 'Allow… (confirm with Touch ID)' && !('waitingForLoan' in q2), JSON.stringify(q2.buttons)); +// 3f (2/11, Gustav: «fjern det der med, at den skal spoerge om lov til at faa adgang til skaermen»): et skaerm-laan med +// ask:false (serverens CMCP_SCREEN_ASK=0) gives uden spoergsmaal - men kun det, kun naar ingen anden har skaermen, +// og ikke lige efter at mennesket tog den tilbage. Samme regel (giverUdenSpoergsmaal) som det rigtige ikon bruger. +const lan = { text: 'Use your screen for 3 minutes: upload seven images', kind: 'screen', minutes: 3 }; +check('3f ask:false, intet andet laan: gives uden spoergsmaal', vis({ ...lan, ask: false }).lendsWithoutAsking === true); +check('3f uden ask-feltet (aeldre server): spoerger', vis(lan).lendsWithoutAsking === false); +check('3f ask:true: spoerger', vis({ ...lan, ask: true }).lendsWithoutAsking === false); +check('3f ask:false paa et ALMINDELIGT samtykke (ikke skaermen): spoerger stadig', vis({ text: 'Send the mail', ask: false }).lendsWithoutAsking === false); +check('3f ask:false paa et goer-selv-spoergsmaal: spoerger stadig', vis({ text: 'Type your password', kind: 'goer-selv', ask: false }).lendsWithoutAsking === false); +check('3f ask:false mens en ANDEN agent har skaermen: venter i koeen', vis({ ...lan, ask: false, simulateActiveLoan: { client: 'anden-agent', minutesLeft: 4 } }).lendsWithoutAsking === false); +check('3f ask:false 30 s efter at mennesket tog skaermen tilbage: venter', vis({ ...lan, ask: false, simulateTakenBackSecondsAgo: 30 }).lendsWithoutAsking === false); +check('3f ask:false 130 s efter: gives igen', vis({ ...lan, ask: false, simulateTakenBackSecondsAgo: 130 }).lendsWithoutAsking === true); + // 4. Modellen kan ikke tegne sine egne knapper ind. const s = vis({ text: 'Press "Gem"\nAllow… (confirm with Touch ID)‮' }); check('4 linjeskift og retningstegn i teksten bliver ikke til egne linjer eller knapper', From cbc902ef298b45a85caaf4858a04aa12b3d7c838 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Mon, 2 Nov 2026 02:06:14 +0100 Subject: [PATCH 19/94] Skaermlaan uden spoergsmaal: beskrivelse, README og ikonets kontrakter - tik() giver et ventende laan uden spoergsmaal (hvert sekund), saa husets kildekontrakter for laanOpdateret, tagTilbageNu og stopAlleNu staar uroert - spaerringen efter tag-tilbage / stop-alle saettes foer tik() i begge - computer_request_screen sender ikke agenten hen til Allow, naar CMCP_SCREEN_ASK=0 (proeve 14 maaler beskrivelsen) - README + den udledte npm-README Co-Authored-By: Claude Opus 5.5 --- README.md | 8 ++++++-- helper/Sources/cmcp-status/main.swift | 13 ++++++------- mcp-server/README.md | 8 ++++++-- mcp-server/index.js | 13 ++++++++++++- test/skaerm-laan.mjs | 4 ++++ 5 files changed, 34 insertions(+), 12 deletions(-) diff --git a/README.md b/README.md index e8a14efd..abf7fb4a 100644 --- a/README.md +++ b/README.md @@ -251,8 +251,12 @@ most 15 minutes. While it has the screen, each step waits while you are using th keyboard or mouse (a step already running finishes), and `Take the screen back now` ends the loan at once and stops a step that is still running. That button stays in the box for as long as the loan lasts - also when the agent is quiet and -when you have switched the box off - and it never asks for Touch ID. Setting `CMCP_BACKGROUND` locks it -out entirely. `CMCP_BACKGROUND=0` +when you have switched the box off - and it never asks for Touch ID. If you would rather not be +asked at all, set `CMCP_SCREEN_ASK=0`: the loan is then given at once, with no box and no Touch ID - +still one agent at a time, each step still waits while you are using the keyboard or mouse, and Esc, +⌃⌥⌘. or `Take the screen back now` still take it back (after that, no agent gets it without asking +for two minutes). A typo keeps the question; only `0`, `false`, `no` or `off` remove it. Setting +`CMCP_BACKGROUND` locks the screen out entirely. `CMCP_BACKGROUND=0` gives you those too - and a typo will not turn it off, only `0`, `false`, `no` or `off`. `CMCP_MODE=ask` puts one consent question per session in front of the first write, and `CMCP_MODE=readonly` leaves you the fourteen that only look. diff --git a/helper/Sources/cmcp-status/main.swift b/helper/Sources/cmcp-status/main.swift index 883df62c..e89ef7d9 100644 --- a/helper/Sources/cmcp-status/main.swift +++ b/helper/Sources/cmcp-status/main.swift @@ -767,6 +767,7 @@ final class Ikon: NSObject, NSMenuDelegate, UNUserNotificationCenterDelegate { } func tik() { + givStaaendeLaan() // 2/11: et ventende laan uden spoergsmaal gives, saa snart skaermen er fri (og spaerringen udloebet) let s = laesSessioner() let aabne = anmodninger.filter { !$0.besvaret } if !aabne.isEmpty { @@ -1072,12 +1073,12 @@ final class Ikon: NSObject, NSMenuDelegate, UNUserNotificationCenterDelegate { /// skriver den, stopper alle med samme mappe - kendt graense; en agent med en skal kan omgaa alt). @objc func stopAlle() { stopAlleNu(kilde: "stop-all") } func stopAlleNu(kilde: String) { + spaerStaaende() // 2/11: foer tik(), som ellers kunne give et laan uden spoergsmaal i stop-oejeblikket noterKilde(kilde) let sti = (stateDir as NSString).appendingPathComponent(STOP_FIL) let post = "{\"ts\":\(Int(Date().timeIntervalSince1970 * 1000)),\"source\":\"\(kilde)\"}\n" // R45 (Opus G): en fejlet skrivning maa ikke vaere tavs - lyd + note; laanet gives tilbage uanset. do { try post.write(toFile: sti, atomically: true, encoding: .utf8) } catch { NSSound.beep(); noterKilde("stop-all-write-failed") } - spaerStaaende() aktivtLaan?.afslutLaan() tik() } @@ -1085,16 +1086,15 @@ final class Ikon: NSObject, NSMenuDelegate, UNUserNotificationCenterDelegate { /// Menuens og boksens stopknap: samme vej, hvert sit kildemaerke (R22). func tagTilbageNu(kilde: String) { noterKilde(kilde) - spaerStaaende() aktivtLaan?.afslutLaan() + spaerStaaende() // 2/11: foer tik() - og foer lukningens oprydning, som koerer bagefter (DispatchQueue.main.async) tik() } /// 2/11: efter et «tag tilbage» / «stop alle» faar ingen agent skaermen uden spoergsmaal i STAAENDE_PAUSE sekunder. - /// Saettes FOER laanet lukkes: lukningen kalder laanOpdateret -> givStaaendeLaan, som saa ser spaerringen. + /// Saettes foer tik() i samme tur paa hovedtraaden; tik() (hvert sekund) giver det ventende laan, naar den udloeber. func spaerStaaende() { staaendeSpaerretTil = Date().addingTimeInterval(STAAENDE_PAUSE) - DispatchQueue.main.asyncAfter(deadline: .now() + STAAENDE_PAUSE + 0.5) { [weak self] in self?.givStaaendeLaan() } } /// ⛔ 2/11 (Gustav: «fjern det der med, at den skal spoerge om lov til at faa adgang til skaermen. Det skal den bare @@ -1112,13 +1112,12 @@ final class Ikon: NSObject, NSMenuDelegate, UNUserNotificationCenterDelegate { let til = Date().addingTimeInterval(Double(minutter) * 60) a.svarLaan(til: til.timeIntervalSince1970 * 1000, verified: "standing") anmodninger.removeAll { $0 === a } - if a.lukket { tik(); return } + if a.lukket { return } aktivtLaan = a; laanTil = til laanOpdateret() // S2b-2: Esc bliver stoptast, saa laenge laanet varer DispatchQueue.main.asyncAfter(deadline: .now() + Double(minutter) * 60) { if aktivtLaan === a { a.afslutLaan() } } - tik() } /// «Done» paa et goer-selv-spoergsmaal: et signal, ikke et samtykke. @@ -1270,5 +1269,5 @@ if !genveje.stopRegistreret { ikon.noterKilde("stop-all-hotkey-unavailable") } genveje.vedStop = { ikon.stopAlleNu(kilde: "stop-all-hotkey") } genveje.vedEsc = { ikon.stopAlleNu(kilde: "stop-all-esc-loan") } nyAnmodning = { a in ikon.vis(a) } -laanOpdateret = { genveje.laan(aktivtLaan.map { !$0.lukket } ?? false); ikon.tik(); ikon.givStaaendeLaan() } +laanOpdateret = { genveje.laan(aktivtLaan.map { !$0.lukket } ?? false); ikon.tik() } app.run() diff --git a/mcp-server/README.md b/mcp-server/README.md index 5008e47c..7886c7ba 100644 --- a/mcp-server/README.md +++ b/mcp-server/README.md @@ -249,8 +249,12 @@ most 15 minutes. While it has the screen, each step waits while you are using th keyboard or mouse (a step already running finishes), and `Take the screen back now` ends the loan at once and stops a step that is still running. That button stays in the box for as long as the loan lasts - also when the agent is quiet and -when you have switched the box off - and it never asks for Touch ID. Setting `CMCP_BACKGROUND` locks it -out entirely. `CMCP_BACKGROUND=0` +when you have switched the box off - and it never asks for Touch ID. If you would rather not be +asked at all, set `CMCP_SCREEN_ASK=0`: the loan is then given at once, with no box and no Touch ID - +still one agent at a time, each step still waits while you are using the keyboard or mouse, and Esc, +⌃⌥⌘. or `Take the screen back now` still take it back (after that, no agent gets it without asking +for two minutes). A typo keeps the question; only `0`, `false`, `no` or `off` remove it. Setting +`CMCP_BACKGROUND` locks the screen out entirely. `CMCP_BACKGROUND=0` gives you those too - and a typo will not turn it off, only `0`, `false`, `no` or `off`. `CMCP_MODE=ask` puts one consent question per session in front of the first write, and `CMCP_MODE=readonly` leaves you the fourteen that only look. diff --git a/mcp-server/index.js b/mcp-server/index.js index 0fb70eb7..b651348e 100644 --- a/mcp-server/index.js +++ b/mcp-server/index.js @@ -283,7 +283,9 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({ // tilbydes nu - modellen faar besked om at navngive programmet, og saa // virker de uden at nogen maerker det. .filter(t => !baggrund() || !TAGER_SKAERMEN.has(t.name) || KAN_STILLES.has(t.name)) - .map(({ name, description, inputSchema }) => ({ name, description, inputSchema })) + // 2/11: med CMCP_SCREEN_ASK=0 maa beskrivelsen ikke bede agenten sende mennesket hen til en Allow-knap, der ikke kommer. + .map(({ name, description, inputSchema }) => ({ name, inputSchema, + description: name === 'computer_request_screen' && skaermUdenSpoergsmaal() ? SKAERM_UDEN_SPOERGSMAAL : description })) })); function textResult(obj) { @@ -399,6 +401,15 @@ let sidsteEgenHandling = 0; const klientNavn = () => server.getClientVersion?.()?.name || process.env.CMCP_CLIENT || null; async function meldListe() { try { await server.sendToolListChanged(); } catch { /* klienten lytter ikke */ } } +const SKAERM_UDEN_SPOERGSMAAL = 'Take the screen for a while - for the few steps that cannot be done from behind: moving the pointer, ' + + 'dragging, bringing a window forward, switching desktop, a file dialog. The person has set this Mac to lend the screen without asking ' + + '(CMCP_SCREEN_ASK=0): nobody is asked, and the loan is given at once - or as soon as another agent\'s loan ends - for at most 15 minutes. ' + + 'Each step still waits while the person is using the keyboard or mouse, and they can take the screen back at any moment (Esc, ' + + 'Control-Option-Command-period, or Take the screen back now); after that no agent gets it for two minutes, so if you are refused, wait and ' + + 'ask again. Password apps, deletions, and messages in the apps and web chats it recognises still ask. Say in `reason` what you need ' + + 'the screen for. action "release" hands it back when you are done; "status" tells you whether you have it. Refused if the person has ' + + 'locked the server to background (CMCP_BACKGROUND set).'; + async function skaermLaan(args) { const handling = args.action || 'request'; const log = (decision, reason, asked = false) => record({ tool: 'computer_request_screen', tier: TIER.WRITE, diff --git a/test/skaerm-laan.mjs b/test/skaerm-laan.mjs index e27c2a0a..831efeb7 100644 --- a/test/skaerm-laan.mjs +++ b/test/skaerm-laan.mjs @@ -98,6 +98,7 @@ function server(state, hj, ekstra = {}) { async klar() { await rpc('initialize', { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'chat-laan', version: '1' } }); srv.stdin.write(JSON.stringify({ jsonrpc: '2.0', method: 'notifications/initialized' }) + '\n'); }, async navne() { return ((await rpc('tools/list')).result?.tools || []).map(t => t.name); }, + async beskrivelse(navn) { return ((await rpc('tools/list')).result?.tools || []).find(t => t.name === navn)?.description || ''; }, async kald(name, args) { const r = await rpc('tools/call', { name, arguments: args }); return { fejl: !!r.result?.isError, tekst: r.result?.content?.[0]?.text || JSON.stringify(r.error || {}) }; } }; @@ -435,6 +436,9 @@ for (const [navn, ekstra, uden] of [['uden kontakten', {}, false], ['tastefejl try { await A.klar(); saet({ idle: { idle: 30 } }); + const besk = await A.beskrivelse('computer_request_screen'); + check(`14 ${navn}: vaerktoejsbeskrivelsen ${uden ? 'siger at ingen spoerges' : 'sender stadig mennesket til Allow (Touch ID)'}`, + uden ? /without asking/.test(besk) && !/press Allow/.test(besk) : /press Allow \(Touch ID\)/.test(besk) && !/without asking/.test(besk), besk.slice(0, 120)); const r = await A.kald('computer_request_screen', { action: 'request', reason: 'upload seven images', minutes: 3 }); const q = ik.spurgt.at(-1); if (!uden) { From ac7d15ef46865ec9a32807017caf11ebb8f5421c Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Mon, 2 Nov 2026 02:32:49 +0100 Subject: [PATCH 20/94] =?UTF-8?q?Panel=20R1=20(Astra):=20spaerringen=20mon?= =?UTF-8?q?oton=20og=20gemt,=20overdragelsespause,=20=C3=A6rlig=20log?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - spaerringen efter tag-tilbage/stop-alle maales i systemUptime (et vaegur der springer, loefter den ikke) og gemmes i skaerm-spaerret.json, saa et ikon der genstarter inden for pausen holder den; en vaerdi laengere fremme end pausen er ugyldig - et laan uden spoergsmaal gives tidligst 3 s efter at det forrige sluttede (den forriges hjaelpere faar SIGKILL 2 s efter SIGTERM) - loggens «asked» foelger svaret: et aeldre ikon der spoerger og svarer owner, logges asked:true Proever 3g (5 tjek) og 14b (2 tjek). Co-Authored-By: Claude Opus 5.5 --- helper/Sources/cmcp-status/Tekst.swift | 28 ++++++++++++++-- helper/Sources/cmcp-status/main.swift | 44 ++++++++++++++++++++------ mcp-server/godkend.js | 7 ++-- mcp-server/index.js | 3 +- test/ikon-menu.mjs | 15 ++++++++- test/skaerm-laan.mjs | 17 ++++++++++ 6 files changed, 96 insertions(+), 18 deletions(-) diff --git a/helper/Sources/cmcp-status/Tekst.swift b/helper/Sources/cmcp-status/Tekst.swift index 283f8418..66b4e02f 100644 --- a/helper/Sources/cmcp-status/Tekst.swift +++ b/helper/Sources/cmcp-status/Tekst.swift @@ -171,15 +171,37 @@ enum TouchIdUdfald: Equatable { case laan, svar(Bool) } /// overlevede proeven). func touchIdUdfald(ok: Bool, erLaan: Bool) -> TouchIdUdfald { ok && erLaan ? .laan : .svar(ok) } +/// 2/11: efter «tag tilbage» / «stop alle» faar ingen agent skaermen uden spoergsmaal i saa mange sekunder. +let STAAENDE_PAUSE: Double = 120 +/// R1 (Astra P1): et nyt laan uden spoergsmaal gives tidligst saa mange sekunder efter at det forrige sluttede - den +/// forrige agents hjaelpere faar SIGTERM, og SIGKILL 2 s efter (helper.js draebBlidt), foer den naeste maa begynde. +let OVERDRAG_PAUSE: Double = 3 +/// R1 (Astra P1): spaerringen gemmes her (vaegur, ms), saa den overlever at ikonet genstartes. +let SPAERRING_FIL = "skaerm-spaerret.json" + /// 2/11: gives denne anmodning skaermen STRAKS uden spoergsmaal? Kun et skaerm-laan, kun naar serveren bad om det -/// (ask == false - nil og true spoerger), kun naar ingen anden agent har skaermen, og ikke mens spaerringen efter -/// menneskets «tag tilbage» / «stop alle» staar. Bor her, saa proeven (--dump-question) maaler den samme regel. -func giverUdenSpoergsmaal(kind: String?, ask: Bool?, andetLaanAktivt: Bool, spaerretTil: Date?, nu: Date = Date()) -> Bool { +/// (ask == false - nil og true spoerger), kun naar ingen anden agent har skaermen, ikke mens spaerringen efter +/// menneskets «tag tilbage» / «stop alle» staar, og ikke foer OVERDRAG_PAUSE efter det forrige laan. Alle tider er +/// MONOTONE (systemUptime, sekunder) - et vaegur der springer, kan ikke loefte spaerringen (R1, Astra P1). +/// Bor her, saa proeven (--dump-question) maaler den samme regel. +func giverUdenSpoergsmaal(kind: String?, ask: Bool?, andetLaanAktivt: Bool, spaerretTil: Double?, ledigFra: Double?, nu: Double) -> Bool { guard kind == "screen", ask == false, !andetLaanAktivt else { return false } if let t = spaerretTil, t > nu { return false } + if let l = ledigFra, l > nu { return false } return true } +/// Spaerringen i SPAERRING_FIL (`{"until": }`) -> sekunder tilbage, eller nil. En vaerdi laengere fremme end +/// pausen (et ur der er sprunget, en fil fra foer en genstart af Mac'en) er ugyldig og laaser ikke for evigt. +func spaerringTilbage(filTekst: String?, nuMs: Double) -> Double? { + guard let t = filTekst, let d = t.data(using: .utf8), + let o = try? JSONSerialization.jsonObject(with: d) as? [String: Any], + let til = (o["until"] as? Double) ?? (o["until"] as? Int).map(Double.init) else { return nil } + let rest = (til - nuMs) / 1000 + guard rest > 0, rest <= STAAENDE_PAUSE + 1 else { return nil } + return rest +} + enum BoksHandling: Equatable { case foelg, tagTilbage, stopAlle, tillad(String), afvis(String), gjort(String), hentFrem(String), intet } /// Hvad et tryk paa en boksknap betyder. Knappen baerer sit eget spoergsmaal (`knapNonce`); diff --git a/helper/Sources/cmcp-status/main.swift b/helper/Sources/cmcp-status/main.swift index e89ef7d9..71200b2c 100644 --- a/helper/Sources/cmcp-status/main.swift +++ b/helper/Sources/cmcp-status/main.swift @@ -185,8 +185,10 @@ var aktivtLaan: Anmodning? var laanTil: Date? /// 2/11: tog mennesket skaermen tilbage (eller stoppede alle), gives intet laan UDEN spoergsmaal foer dette tidspunkt - /// ellers fik den naeste agent i koeen skaermen i samme oejeblik, som mennesket tog den. -var staaendeSpaerretTil: Date? -let STAAENDE_PAUSE: Double = 120 +var staaendeSpaerretTil: Double? // systemUptime (monotont) +/// R1 (Astra P1): hvornaar det forrige laan sluttede + OVERDRAG_PAUSE (systemUptime). Foer det gives intet laan uden spoergsmaal. +var laanLedigFra: Double? +func oppetid() -> Double { ProcessInfo.processInfo.systemUptime } var laanOpdateret: () -> Void = {} /// S2b-2/R53: blev ⌃⌥⌘. registreret? (saettes ved start; menuen viser kun genvejen, hvis den virker) var genvejeVirker: () -> Bool = { false } @@ -275,7 +277,7 @@ func laesSpoergsmaal(_ k: Int32) { a.ctx?.invalidate() anmodninger.removeAll { $0 === a } // Forbindelsen er lukket: var det et laan, er skaermen menneskets igen. - if aktivtLaan === a { aktivtLaan = nil; laanTil = nil; laanOpdateret() } + if aktivtLaan === a { laanLedigFra = oppetid() + OVERDRAG_PAUSE; aktivtLaan = nil; laanTil = nil; laanOpdateret() } } } @@ -577,12 +579,22 @@ if CommandLine.arguments.contains("--dump-question") { if let v = m.ventetekst { ud["waitingForLoan"] = v } // 2/11: ville ikonet give dette laan uden spoergsmaal lige nu? Proeve-kun felt: {"simulateTakenBackSecondsAgo": N} // simulerer menneskets «tag tilbage» for N sekunder siden (spaerringen er STAAENDE_PAUSE sekunder). - var spaerret: Date? = nil - if let raw = try? JSONSerialization.jsonObject(with: raa) as? [String: Any], - let siden = (raw["simulateTakenBackSecondsAgo"] as? Double) ?? (raw["simulateTakenBackSecondsAgo"] as? Int).map(Double.init) { - spaerret = Date().addingTimeInterval(STAAENDE_PAUSE - siden) + // {"simulateLoanEndedSecondsAgo": N}: det forrige laan sluttede for N sekunder siden. Og spaerringen i + // SPAERRING_FIL i tilstandsmappen laeses som ved ikonets start (R1: den overlever en genstart). + let nu = oppetid() + var spaerret: Double? = spaerringTilbage(filTekst: try? String(contentsOfFile: (stateDir as NSString).appendingPathComponent(SPAERRING_FIL), encoding: .utf8), + nuMs: Date().timeIntervalSince1970 * 1000).map { nu + $0 } + var ledig: Double? = nil + if let raw = try? JSONSerialization.jsonObject(with: raa) as? [String: Any] { + if let siden = (raw["simulateTakenBackSecondsAgo"] as? Double) ?? (raw["simulateTakenBackSecondsAgo"] as? Int).map(Double.init) { + spaerret = nu + STAAENDE_PAUSE - siden + } + if let siden = (raw["simulateLoanEndedSecondsAgo"] as? Double) ?? (raw["simulateLoanEndedSecondsAgo"] as? Int).map(Double.init) { + ledig = nu + OVERDRAG_PAUSE - siden + } } - ud["lendsWithoutAsking"] = giverUdenSpoergsmaal(kind: s.kind, ask: s.ask, andetLaanAktivt: aktivtAndetLaan != nil, spaerretTil: spaerret) + ud["lendsWithoutAsking"] = giverUdenSpoergsmaal(kind: s.kind, ask: s.ask, andetLaanAktivt: aktivtAndetLaan != nil, + spaerretTil: spaerret, ledigFra: ledig, nu: nu) if s.kind == "screen" { let minutter = max(1, min(15, s.minutes ?? 10)) ud["whileLent"] = laanLinjer(klient: s.client, til: Date().addingTimeInterval(Double(minutter) * 60)) @@ -1094,7 +1106,12 @@ final class Ikon: NSObject, NSMenuDelegate, UNUserNotificationCenterDelegate { /// 2/11: efter et «tag tilbage» / «stop alle» faar ingen agent skaermen uden spoergsmaal i STAAENDE_PAUSE sekunder. /// Saettes foer tik() i samme tur paa hovedtraaden; tik() (hvert sekund) giver det ventende laan, naar den udloeber. func spaerStaaende() { - staaendeSpaerretTil = Date().addingTimeInterval(STAAENDE_PAUSE) + staaendeSpaerretTil = oppetid() + STAAENDE_PAUSE + // R1 (Astra P1): gemt, saa et ikon der genstarter inden for pausen, ogsaa holder den. Fejler skrivningen, holder + // spaerringen stadig i denne proces - og det noteres. + let post = "{\"until\":\(Int(Date().timeIntervalSince1970 * 1000 + STAAENDE_PAUSE * 1000))}\n" + do { try post.write(toFile: (stateDir as NSString).appendingPathComponent(SPAERRING_FIL), atomically: true, encoding: .utf8) } + catch { noterKilde("standing-block-write-failed") } } /// ⛔ 2/11 (Gustav: «fjern det der med, at den skal spoerge om lov til at faa adgang til skaermen. Det skal den bare @@ -1105,8 +1122,10 @@ final class Ikon: NSObject, NSMenuDelegate, UNUserNotificationCenterDelegate { /// now» tager den tilbage. Svaret siger «standing», ikke «owner»: ingen bekraeftede noget i dette oejeblik. func givStaaendeLaan() { let andetAktivt = aktivtLaan.map { !$0.lukket } ?? false + let nu = oppetid() guard let a = anmodninger.first(where: { !$0.besvaret && !$0.lukket - && giverUdenSpoergsmaal(kind: $0.s.kind, ask: $0.s.ask, andetLaanAktivt: andetAktivt, spaerretTil: staaendeSpaerretTil) }) + && giverUdenSpoergsmaal(kind: $0.s.kind, ask: $0.s.ask, andetLaanAktivt: andetAktivt, + spaerretTil: staaendeSpaerretTil, ledigFra: laanLedigFra, nu: nu) }) else { return } let minutter = max(1, min(15, a.s.minutes ?? 10)) let til = Date().addingTimeInterval(Double(minutter) * 60) @@ -1269,5 +1288,10 @@ if !genveje.stopRegistreret { ikon.noterKilde("stop-all-hotkey-unavailable") } genveje.vedStop = { ikon.stopAlleNu(kilde: "stop-all-hotkey") } genveje.vedEsc = { ikon.stopAlleNu(kilde: "stop-all-esc-loan") } nyAnmodning = { a in ikon.vis(a) } +// R1 (Astra P1): en spaerring fra et tidligere ikon (genstartet inden for pausen) gaelder stadig. +if let rest = spaerringTilbage(filTekst: try? String(contentsOfFile: (stateDir as NSString).appendingPathComponent(SPAERRING_FIL), encoding: .utf8), + nuMs: Date().timeIntervalSince1970 * 1000) { + staaendeSpaerretTil = oppetid() + rest +} laanOpdateret = { genveje.laan(aktivtLaan.map { !$0.lukket } ?? false); ikon.tik() } app.run() diff --git a/mcp-server/godkend.js b/mcp-server/godkend.js index 5dc9af51..d9455b12 100644 --- a/mcp-server/godkend.js +++ b/mcp-server/godkend.js @@ -222,18 +222,19 @@ export async function laanSkaermen({ session, client, text, minutter, spoerg = t if (m.ok === true && m.verified === 'owner') { const vores = Date.now() + minutter * 60_000; const til = Math.min(vores, Number(m.until) > 0 ? Number(m.until) : vores); - return afgoer({ ok: true, til, afslut: () => sock.destroy(), grund: 'the person gave this agent the screen and confirmed it was them' }); + return afgoer({ ok: true, til, afslut: () => sock.destroy(), grund: 'the person gave this agent the screen and confirmed it was them', spurgt: true }); } // 2/11: «standing» = ikonet gav laanet uden et spoergsmaal. Godtages KUN naar denne server selv bad om det // (CMCP_SCREEN_ASK=0) - ellers er det et svar paa noget ingen har slaaet til, og det er et nej. if (m.ok === true && m.verified === 'standing' && !spoerg) { const vores = Date.now() + minutter * 60_000; const til = Math.min(vores, Number(m.until) > 0 ? Number(m.until) : vores); - return afgoer({ ok: true, til, afslut: () => sock.destroy(), grund: 'the person has set this Mac to lend the screen without asking (CMCP_SCREEN_ASK=0)' }); + return afgoer({ ok: true, til, afslut: () => sock.destroy(), grund: 'the person has set this Mac to lend the screen without asking (CMCP_SCREEN_ASK=0)', spurgt: false }); } if (m.verified === 'optaget') { afgoer({ ok: false, grund: 'another agent has the screen right now' }); return sock.destroy(); } if (m.ok === false) pauseTil = Date.now() + PAUSE_MS; - afgoer({ ok: false, grund: m.ok === false ? 'the person said no in the menu bar' : 'the answer was not confirmed by the person (Touch ID or password)' }); + // R1 (Astra P2): loggens «asked» foelger hvad der faktisk skete - et nej i boksen er et spoergsmaal. + afgoer({ ok: false, spurgt: m.ok === false ? true : undefined, grund: m.ok === false ? 'the person said no in the menu bar' : 'the answer was not confirmed by the person (Touch ID or password)' }); sock.destroy(); }); const luk = () => { diff --git a/mcp-server/index.js b/mcp-server/index.js index b651348e..fbe66d01 100644 --- a/mcp-server/index.js +++ b/mcp-server/index.js @@ -477,7 +477,8 @@ async function skaermLaan(args) { if (kaldStoppet()) return errorResult('Stopped: the person pressed «Stop all agents now», so the screen was handed straight back. Ask them in the chat what they want before you continue.'); return errorResult('Cancelled: the client cancelled this call, so the screen was handed straight back.'); } - log(svar.ok ? 'allowed' : 'denied', svar.grund, spoerg); + // R1 (Astra P2): et aeldre ikon spoerger stadig og svarer «owner» - saa blev mennesket spurgt, uanset kontakten. + log(svar.ok ? 'allowed' : 'denied', svar.grund, svar.spurgt ?? spoerg); // R45 (Opus F): et stop under ventetiden er ikke et nej - «use the quiet tools» ville bede agenten fortsaette. if (!svar.ok && kaldStoppet()) return errorResult(`Stopped: ${svar.grund}. Ask them in the chat what they want before you continue.`); if (!svar.ok) { diff --git a/test/ikon-menu.mjs b/test/ikon-menu.mjs index 26b27633..d0235644 100644 --- a/test/ikon-menu.mjs +++ b/test/ikon-menu.mjs @@ -7,7 +7,7 @@ // tekst som JSON UDEN at vise noget. Ikonet startes aldrig her. import './ryd-op.mjs'; import { execFileSync } from 'node:child_process'; -import { existsSync, statSync, mkdtempSync } from 'node:fs'; +import { existsSync, statSync, mkdtempSync, writeFileSync, unlinkSync } from 'node:fs'; import { tmpdir } from 'node:os'; import { join, dirname } from 'node:path'; import { fileURLToPath } from 'node:url'; @@ -87,6 +87,19 @@ check('3f ask:false paa et goer-selv-spoergsmaal: spoerger stadig', vis({ text: check('3f ask:false mens en ANDEN agent har skaermen: venter i koeen', vis({ ...lan, ask: false, simulateActiveLoan: { client: 'anden-agent', minutesLeft: 4 } }).lendsWithoutAsking === false); check('3f ask:false 30 s efter at mennesket tog skaermen tilbage: venter', vis({ ...lan, ask: false, simulateTakenBackSecondsAgo: 30 }).lendsWithoutAsking === false); check('3f ask:false 130 s efter: gives igen', vis({ ...lan, ask: false, simulateTakenBackSecondsAgo: 130 }).lendsWithoutAsking === true); +// 3g (panel R1, Astra P1): (a) overdragelsen venter OVERDRAG_PAUSE (3 s) efter at et laan sluttede - den forriges hjaelpere +// faar SIGKILL 2 s efter SIGTERM (helper.js draebBlidt); (b) spaerringen efter «tag tilbage» overlever at ikonet +// genstartes: den laeses fra skaerm-spaerret.json i tilstandsmappen, og en vaerdi laengere fremme end pausen er ugyldig. +check('3g et laan sluttede for 1 s siden: den naeste venter', vis({ ...lan, ask: false, simulateLoanEndedSecondsAgo: 1 }).lendsWithoutAsking === false); +check('3g ...for 4 s siden: gives', vis({ ...lan, ask: false, simulateLoanEndedSecondsAgo: 4 }).lendsWithoutAsking === true); +const SPF = join(STATE, 'skaerm-spaerret.json'); +writeFileSync(SPF, JSON.stringify({ until: Date.now() + 60_000 })); +check('3g spaerringen fra et tidligere ikon (60 s tilbage) gaelder efter genstart', vis({ ...lan, ask: false }).lendsWithoutAsking === false); +writeFileSync(SPF, JSON.stringify({ until: Date.now() - 1000 })); +check('3g ...en udloebet spaerring i filen: gives', vis({ ...lan, ask: false }).lendsWithoutAsking === true); +writeFileSync(SPF, JSON.stringify({ until: Date.now() + 10 * 86_400_000 })); +check('3g ...en spaerring 10 dage frem (ugyldig) laaser ikke for evigt', vis({ ...lan, ask: false }).lendsWithoutAsking === true); +unlinkSync(SPF); // 4. Modellen kan ikke tegne sine egne knapper ind. const s = vis({ text: 'Press "Gem"\nAllow… (confirm with Touch ID)‮' }); diff --git a/test/skaerm-laan.mjs b/test/skaerm-laan.mjs index 831efeb7..269ecb76 100644 --- a/test/skaerm-laan.mjs +++ b/test/skaerm-laan.mjs @@ -463,5 +463,22 @@ for (const [navn, ekstra, uden] of [['uden kontakten', {}, false], ['tastefejl } finally { A.srv.kill(); } } +// 14b (panel R1, Astra P2): med kontakten slaaet til, men et AELDRE ikon der stadig spoerger og svarer «owner» (eller et +// menneske der svarer i boksen under spaerringen): laanet gives, og loggen siger at mennesket BLEV spurgt. +{ + const st = mkdtempSync(join(tmpdir(), 'cmcp-laan-gl-')); + const ik = await lavIkon(st); + ik.svar = 'ja'; + const A = server(st, HJ, { CMCP_SCREEN_ASK: '0' }); + try { + await A.klar(); + const r = await A.kald('computer_request_screen', { action: 'request', reason: 'older icon still asks', minutes: 2 }); + const linje = laanLog(st).at(-1); + check('14b kontakten til + et ikon der spoerger og svarer «owner»: laanet givet', !r.fejl && /"granted":\s*true/.test(r.tekst), r.tekst.slice(0, 90)); + check('14b ...og loggen siger asked:true og «confirmed it was them» - ikke «without asking»', + linje?.decision === 'allowed' && linje?.asked === true && /confirmed it was them/.test(linje?.reason || ''), JSON.stringify(linje || {}).slice(0, 200)); + } finally { A.srv.kill(); } +} + console.log(fails.length ? `DUMPET: ${fails.length} tjek` : 'Alle tjek bestået.'); process.exit(fails.length ? 1 : 0); From 89970394d6765dd460f75fa3906f32891b3ca239 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Mon, 2 Nov 2026 02:40:17 +0100 Subject: [PATCH 21/94] Panel R1 (Opus): stop betyder stop, koe-ventetid betyder spoerg igen, kontrakter paa kaldestederne MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - beskrivelsen med CMCP_SCREEN_ASK=0: tager mennesket skaermen tilbage (knap, Esc, ⌃⌥⌘.), stopper agenten og spoerger i chatten - aldrig selv igen - en udloebet ventetid i koeen uden spoergsmaal er ikke et nej: «ask again» - afvisningen i baggrund siger, at serveren laaner uden spoergsmaal - README: «no question» (boksen staar der stadig), nej/fra, Esc-forbehold, tillidsforbehold; undtagelsen ved «a yes without your fingerprint is a no» - CHANGELOG 0.4.0 (in progress) - ikon-boks 5z: kildekontrakter for givStaaendeLaan, tik, tagTilbageNu, stopAlleNu, spaerringsfilen og overdragelsespausen (Opus' MA/MB overlevede) Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 10 ++++++++++ README.md | 18 ++++++++++++------ mcp-server/godkend.js | 3 ++- mcp-server/index.js | 25 ++++++++++++++++--------- test/ikon-boks.mjs | 13 +++++++++++++ test/skaerm-laan.mjs | 24 +++++++++++++++++++++++- 6 files changed, 76 insertions(+), 17 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 19c072e1..c7fc7965 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,16 @@ was written down; where a claim has a test, the test is named. ## 0.4.0 (in progress) +**The screen without a question, if you want it.** Set `CMCP_SCREEN_ASK=0` and an +agent that needs the screen borrows it with no question and no Touch ID - at once, or +three seconds after another agent's loan ends, so the one before has stopped. It is +still the same loan: one agent at a time, each step waits while you use the keyboard +or mouse, and `Take the screen back now`, Esc or `⌃⌥⌘.` take it back. After that the +agent is told to stop and ask you in the chat, and no agent gets the screen without a +question for two minutes - measured on a clock that does not jump, and kept if the +menu bar icon restarts. A typo keeps the question. The audit log says whether you were +asked. (`test/skaerm-laan.mjs` 14 + 14b, `test/ikon-menu.mjs` 3f + 3g) + **A stop lets go of the mouse button and starts nothing new.** A drag holds the button down for up to a few seconds, and a click or a key is down for a moment. If the screen loan ended or you pressed `Stop all agents now` in that moment, the diff --git a/README.md b/README.md index abf7fb4a..3b81694e 100644 --- a/README.md +++ b/README.md @@ -252,11 +252,16 @@ keyboard or mouse (a step already running finishes), and `Take the screen back now` ends the loan at once and stops a step that is still running. That button stays in the box for as long as the loan lasts - also when the agent is quiet and when you have switched the box off - and it never asks for Touch ID. If you would rather not be -asked at all, set `CMCP_SCREEN_ASK=0`: the loan is then given at once, with no box and no Touch ID - -still one agent at a time, each step still waits while you are using the keyboard or mouse, and Esc, -⌃⌥⌘. or `Take the screen back now` still take it back (after that, no agent gets it without asking -for two minutes). A typo keeps the question; only `0`, `false`, `no` or `off` remove it. Setting -`CMCP_BACKGROUND` locks the screen out entirely. `CMCP_BACKGROUND=0` +asked at all, set `CMCP_SCREEN_ASK=0` for the server: an agent that needs the screen then gets it +with no question and no Touch ID - at once, or a few seconds after another agent's loan ends. The +rest of the loan is the same: one agent at a time (per menu bar icon), each step waits while you are +using the keyboard or mouse, the box shows who has it with `Take the screen back now`, and while the +loan lasts Esc is your stop key too (when the icon could register it). Take it back, and that agent +is told to stop and ask you in the chat; no agent gets the screen without a question for two minutes, +also if the icon restarts. The switch is the server's own configuration: anything that can set it, or +talk to the icon as you, can borrow the screen - just as `CMCP_BACKGROUND=0` already hands over the +foreground. A typo keeps the question; only `0`, `false`, `no`, `off`, `nej` or `fra` remove it. +Setting `CMCP_BACKGROUND` locks the screen out entirely. `CMCP_BACKGROUND=0` gives you those too - and a typo will not turn it off, only `0`, `false`, `no` or `off`. `CMCP_MODE=ask` puts one consent question per session in front of the first write, and `CMCP_MODE=readonly` leaves you the fourteen that only look. @@ -398,7 +403,8 @@ all this product puts on your screen, and neither ever takes focus. Mac's password) every time. The answer travels back down the same socket connection the question came in on, bound to a one-time number with a deadline. A late answer, a different number, - or a yes without your fingerprint is a no. + or a yes without your fingerprint is a no. The one exception is the screen loan + on a server you set to `CMCP_SCREEN_ASK=0`, which is lent without a question. - **You see the whole action before you allow it.** The full text sits in the submenu, wrapped, right above `Allow…` - up to 4,000 characters. Anything longer is not asked at all: a yes has to cover everything you saw. diff --git a/mcp-server/godkend.js b/mcp-server/godkend.js index d9455b12..f132c6ef 100644 --- a/mcp-server/godkend.js +++ b/mcp-server/godkend.js @@ -199,7 +199,8 @@ export async function laanSkaermen({ session, client, text, minutter, spoerg = t afslutMaaling(v.ok === true).then((x) => { senesteMaaling = x; }, () => {}).finally(() => resolve(v)); }; const sock = createConnection(IKON_SOCKET); - const ur = setTimeout(() => { afgoer({ ok: false, grund: 'nobody answered in the menu bar in time' }); sock.destroy(); }, timeoutSec * 1000); + const ur = setTimeout(() => { afgoer(spoerg ? { ok: false, grund: 'nobody answered in the menu bar in time' } + : { ok: false, koe: true, spurgt: false, grund: `the screen was not free when the wait of ${Math.round(timeoutSec)} s ran out (another agent had it, or the person took it back less than two minutes ago)` }); sock.destroy(); }, timeoutSec * 1000); // R42: afbrydes kaldet foer svaret, traekkes spoergsmaalet tilbage, og et senere ja kan ikke give laanet. glemLaanAfbrydelse = vedAfbrydelse(() => { if (!svaret) { afgoer({ ok: false, afbrudt: true, grund: afbrudtGrund('the question was withdrawn') }); sock.destroy(); } }); sock.on('connect', () => { diff --git a/mcp-server/index.js b/mcp-server/index.js index fbe66d01..bc9514d9 100644 --- a/mcp-server/index.js +++ b/mcp-server/index.js @@ -401,14 +401,17 @@ let sidsteEgenHandling = 0; const klientNavn = () => server.getClientVersion?.()?.name || process.env.CMCP_CLIENT || null; async function meldListe() { try { await server.sendToolListChanged(); } catch { /* klienten lytter ikke */ } } -const SKAERM_UDEN_SPOERGSMAAL = 'Take the screen for a while - for the few steps that cannot be done from behind: moving the pointer, ' + - 'dragging, bringing a window forward, switching desktop, a file dialog. The person has set this Mac to lend the screen without asking ' + - '(CMCP_SCREEN_ASK=0): nobody is asked, and the loan is given at once - or as soon as another agent\'s loan ends - for at most 15 minutes. ' + - 'Each step still waits while the person is using the keyboard or mouse, and they can take the screen back at any moment (Esc, ' + - 'Control-Option-Command-period, or Take the screen back now); after that no agent gets it for two minutes, so if you are refused, wait and ' + - 'ask again. Password apps, deletions, and messages in the apps and web chats it recognises still ask. Say in `reason` what you need ' + - 'the screen for. action "release" hands it back when you are done; "status" tells you whether you have it. Refused if the person has ' + - 'locked the server to background (CMCP_BACKGROUND set).'; +// R1 (Opus 🔴): et stop maa aldrig blive til «vent og spoerg igen» - Esc og ⌃⌥⌘. ER «stop alle». Efter «tag tilbage» +// stopper agenten og spoerger i chatten. «Bliv ved» (Gustav 2/11) gaelder koeen: er skaermen optaget, venter anmodningen. +const SKAERM_UDEN_SPOERGSMAAL = 'Borrow the screen for a while - for the few steps that cannot be done from behind: moving the pointer, ' + + 'dragging, bringing a window forward, switching desktop, a file dialog. This server is set to borrow it without a question ' + + '(CMCP_SCREEN_ASK=0): nobody is asked, and the loan is given at once - or, if another agent has the screen, a few seconds after ' + + 'that loan ends - for at most 15 minutes. If the wait runs out while another agent still has it, ask again. Each step still ' + + 'waits while the person is using the keyboard or mouse. If the person takes the screen back (Take the screen back now in the box, ' + + 'or Esc or Control-Option-Command-period, which also stop every agent), stop: tell them in the chat what you were doing, and ' + + 'never request the screen again by yourself. Password apps, deletions, and messages in the apps and web chats it recognises ' + + 'still ask. Say in `reason` what you need the screen for. action "release" hands it back as soon as you are done; "status" tells ' + + 'you whether you have it. Refused if the person has locked the server to background (CMCP_BACKGROUND set).'; async function skaermLaan(args) { const handling = args.action || 'request'; @@ -482,6 +485,8 @@ async function skaermLaan(args) { // R45 (Opus F): et stop under ventetiden er ikke et nej - «use the quiet tools» ville bede agenten fortsaette. if (!svar.ok && kaldStoppet()) return errorResult(`Stopped: ${svar.grund}. Ask them in the chat what they want before you continue.`); if (!svar.ok) { + // R1 (Opus): uden spoergsmaal er en udloebet ventetid ikke et nej fra mennesket - en anden agent havde skaermen. + if (svar.koe) return errorResult(`Refused: ${svar.grund}. Nobody said no - ask again in a moment; the screen goes to one agent at a time.`); return errorResult(`Refused: ${svar.grund}. The screen stays with the person - use the quiet tools, and do not ask again with the same request.`); } if (lukketFoerStart) return errorResult('Refused: the screen was taken back the moment it was given. Ask again only if the person wants it.'); @@ -1859,7 +1864,9 @@ async function haandterKald(request) { `In background mode the server never moves the pointer, sends a key press, ` + `brings an app forward, switches desktop, or raises a dialog of its own.\n` + `If this step genuinely needs the screen, ask the person to lend it to you with ` + - `computer_request_screen - they approve it in the box in the corner of their screen (or the menu bar), for a few minutes.\n` + + (skaermUdenSpoergsmaal() + ? `computer_request_screen - this server borrows it without a question (CMCP_SCREEN_ASK=0), for a few minutes.\n` + : `computer_request_screen - they approve it in the box in the corner of their screen (or the menu bar), for a few minutes.\n`) + `Otherwise use the quiet route: computer_find to locate the element, then ` + `computer_press or computer_set_value - they act on a window behind another ` + `one and leave the pointer where the person put it.` diff --git a/test/ikon-boks.mjs b/test/ikon-boks.mjs index 565584b4..afe7df8c 100644 --- a/test/ikon-boks.mjs +++ b/test/ikon-boks.mjs @@ -253,6 +253,19 @@ check('5i boksen tager aldrig tastaturet og beder om ikke at blive delt (sharing /override var canBecomeKey: Bool \{ false \}/.test(m) && s.panel.ikkeDelt && /\.nonactivatingPanel/.test(m)); const tikKrop = krop('func tik() {'); +// 5z (panel R1, Opus: mutanterne MA og MB overlevede): laan uden spoergsmaal - KALDESTEDERNE, ikke kun reglen. +{ + const giv = krop('func givStaaendeLaan('), tilbage = krop('func tagTilbageNu('), stopA = krop('func stopAlleNu('), spaer = krop('func spaerStaaende('); + const foer = (t, a, b) => t.indexOf(a) >= 0 && t.indexOf(b) > t.indexOf(a); + check('5z et laan uden spoergsmaal goer Esc til stoptast (laanOpdateret efter at laanet er sat)', + foer(giv, 'aktivtLaan = a; laanTil = til', 'laanOpdateret()') && /verified: "standing"/.test(giv), giv.slice(0, 160)); + check('5z tik() giver et ventende laan uden spoergsmaal - som det foerste', /^func tik\(\) \{\n\s+givStaaendeLaan\(\)/.test(tikKrop), tikKrop.slice(0, 80)); + check('5z «tag tilbage» og «stop alle» saetter spaerringen FOER tik()', foer(tilbage, 'spaerStaaende()', 'tik()') && foer(stopA, 'spaerStaaende()', 'tik()'), + `${tilbage.slice(0, 120)} · ${stopA.slice(0, 120)}`); + check('5z spaerringen gemmes i SPAERRING_FIL og laeses ved start', /appendingPathComponent\(SPAERRING_FIL\)/.test(spaer) && /staaendeSpaerretTil = oppetid\(\) \+ STAAENDE_PAUSE/.test(spaer) + && /if let rest = spaerringTilbage\([\s\S]{0,320}\{\n\s+staaendeSpaerretTil = oppetid\(\) \+ rest/.test(m)); + check('5z et laan der slutter, giver tidligst det naeste efter OVERDRAG_PAUSE', /if aktivtLaan === a \{ laanLedigFra = oppetid\(\) \+ OVERDRAG_PAUSE; aktivtLaan = nil/.test(m)); +} check('5r synligheden (R24, adfaerd): et laan holder boksen fremme uanset alt; ellers kun naar nogen arbejder, der er sessioner, og boksen ikke er slaaet fra', JSON.stringify(s.synlig) === '[true,false,false,false,true,true,true]', JSON.stringify(s.synlig)); check('5s ...og tik() afgoer det KUN gennem boksSynlig - boksSlaaetFra bruges ikke andre steder i tik()', diff --git a/test/skaerm-laan.mjs b/test/skaerm-laan.mjs index 269ecb76..5cd748af 100644 --- a/test/skaerm-laan.mjs +++ b/test/skaerm-laan.mjs @@ -438,7 +438,10 @@ for (const [navn, ekstra, uden] of [['uden kontakten', {}, false], ['tastefejl saet({ idle: { idle: 30 } }); const besk = await A.beskrivelse('computer_request_screen'); check(`14 ${navn}: vaerktoejsbeskrivelsen ${uden ? 'siger at ingen spoerges' : 'sender stadig mennesket til Allow (Touch ID)'}`, - uden ? /without asking/.test(besk) && !/press Allow/.test(besk) : /press Allow \(Touch ID\)/.test(besk) && !/without asking/.test(besk), besk.slice(0, 120)); + uden ? /without a question/.test(besk) && !/press Allow/.test(besk) : /press Allow \(Touch ID\)/.test(besk) && !/without a question/.test(besk), besk.slice(0, 120)); + // R1 (Opus 🔴): et stop maa ikke blive til «spoerg igen» - beskrivelsen skal sige stop og spoerg i chatten. + if (uden) check(`14 ${navn}: efter «tag tilbage»/Esc siger beskrivelsen stop og spoerg i chatten - aldrig «ask again» om stoppet`, + /take[s]? the screen back[\s\S]{0,200}stop: tell them in the chat[\s\S]{0,80}never request the screen again by yourself/.test(besk), besk.slice(0, 160)); const r = await A.kald('computer_request_screen', { action: 'request', reason: 'upload seven images', minutes: 3 }); const q = ik.spurgt.at(-1); if (!uden) { @@ -480,5 +483,24 @@ for (const [navn, ekstra, uden] of [['uden kontakten', {}, false], ['tastefejl } finally { A.srv.kill(); } } +// 14c (panel R1, Opus): uden spoergsmaal er en udloebet ventetid i koeen IKKE et menneskes nej - svaret maa ikke sige +// «do not ask again», men «nobody said no - ask again». To servere med kontakten, falsk ikon i koe-tilstand. +{ + const st = mkdtempSync(join(tmpdir(), 'cmcp-laan-kv-')); + const ik = await lavIkon(st); ik.svar = 'koe'; ik.laanMs = 60_000; + const K1 = server(st, HJ, { CMCP_SCREEN_ASK: '0', CMCP_SCREEN_WAIT: '1' }); + const K2 = server(st, HJ, { CMCP_SCREEN_ASK: '0', CMCP_SCREEN_WAIT: '1' }); + try { + await Promise.all([K1.klar(), K2.klar()]); + const a = await K1.kald('computer_request_screen', { action: 'request', reason: 'first', minutes: 2 }); + const b = await K2.kald('computer_request_screen', { action: 'request', reason: 'second', minutes: 2 }); + check('14c foerste: laanet', /"granted":\s*true/.test(a.tekst), a.tekst.slice(0, 80)); + check('14c anden: ventetiden loeb ud i koeen - «ask again», ikke «do not ask again»', + b.fejl && /Nobody said no - ask again/.test(b.tekst) && !/do not ask again/.test(b.tekst), b.tekst.slice(0, 160)); + const linje = laanLog(st).filter(x => x.decision === 'denied').at(-1); + check('14c ...og loggen siger asked:false (ingen blev spurgt)', linje?.asked === false, JSON.stringify(linje || {}).slice(0, 160)); + } finally { K1.srv.kill(); K2.srv.kill(); } +} + console.log(fails.length ? `DUMPET: ${fails.length} tjek` : 'Alle tjek bestået.'); process.exit(fails.length ? 1 : 0); From 8311e57eae14808a4381bba5054ff2e96d6f1e82 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Mon, 2 Nov 2026 02:43:38 +0100 Subject: [PATCH 22/94] ikon-boks 5z: kontrakten kraever et KALD paa sin egen linje, ikke teksten i en kommentar MB1 (udkommenteret spaerStaaende) overlevede, fordi indexOf fandt teksten i kommentaren. Nu draebt sammen med MB3 og MB4 (spaerring efter tik). Co-Authored-By: Claude Opus 5.5 --- test/ikon-boks.mjs | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/test/ikon-boks.mjs b/test/ikon-boks.mjs index afe7df8c..f847091b 100644 --- a/test/ikon-boks.mjs +++ b/test/ikon-boks.mjs @@ -256,7 +256,9 @@ const tikKrop = krop('func tik() {'); // 5z (panel R1, Opus: mutanterne MA og MB overlevede): laan uden spoergsmaal - KALDESTEDERNE, ikke kun reglen. { const giv = krop('func givStaaendeLaan('), tilbage = krop('func tagTilbageNu('), stopA = krop('func stopAlleNu('), spaer = krop('func spaerStaaende('); - const foer = (t, a, b) => t.indexOf(a) >= 0 && t.indexOf(b) > t.indexOf(a); + // Et KALD paa sin egen linje - ikke teksten i en kommentar (MB1 overlevede, da «// spaerStaaende()» matchede). + const kald = (t, x) => { const r = new RegExp('\\n[ \\t]+' + x.replace(/[()]/g, '\\$&')); const mm = r.exec(t); return mm ? mm.index : -1; }; + const foer = (t, a, b) => kald(t, a) >= 0 && kald(t, b) > kald(t, a); check('5z et laan uden spoergsmaal goer Esc til stoptast (laanOpdateret efter at laanet er sat)', foer(giv, 'aktivtLaan = a; laanTil = til', 'laanOpdateret()') && /verified: "standing"/.test(giv), giv.slice(0, 160)); check('5z tik() giver et ventende laan uden spoergsmaal - som det foerste', /^func tik\(\) \{\n\s+givStaaendeLaan\(\)/.test(tikKrop), tikKrop.slice(0, 80)); From 1da09dc78615fd1a29cb3903ba59b20091c825bd Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Mon, 2 Nov 2026 02:44:35 +0100 Subject: [PATCH 23/94] npm-README udledt af README (build-release.sh) Co-Authored-By: Claude Opus 5.5 --- mcp-server/README.md | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/mcp-server/README.md b/mcp-server/README.md index 7886c7ba..2aece51b 100644 --- a/mcp-server/README.md +++ b/mcp-server/README.md @@ -250,11 +250,16 @@ keyboard or mouse (a step already running finishes), and `Take the screen back now` ends the loan at once and stops a step that is still running. That button stays in the box for as long as the loan lasts - also when the agent is quiet and when you have switched the box off - and it never asks for Touch ID. If you would rather not be -asked at all, set `CMCP_SCREEN_ASK=0`: the loan is then given at once, with no box and no Touch ID - -still one agent at a time, each step still waits while you are using the keyboard or mouse, and Esc, -⌃⌥⌘. or `Take the screen back now` still take it back (after that, no agent gets it without asking -for two minutes). A typo keeps the question; only `0`, `false`, `no` or `off` remove it. Setting -`CMCP_BACKGROUND` locks the screen out entirely. `CMCP_BACKGROUND=0` +asked at all, set `CMCP_SCREEN_ASK=0` for the server: an agent that needs the screen then gets it +with no question and no Touch ID - at once, or a few seconds after another agent's loan ends. The +rest of the loan is the same: one agent at a time (per menu bar icon), each step waits while you are +using the keyboard or mouse, the box shows who has it with `Take the screen back now`, and while the +loan lasts Esc is your stop key too (when the icon could register it). Take it back, and that agent +is told to stop and ask you in the chat; no agent gets the screen without a question for two minutes, +also if the icon restarts. The switch is the server's own configuration: anything that can set it, or +talk to the icon as you, can borrow the screen - just as `CMCP_BACKGROUND=0` already hands over the +foreground. A typo keeps the question; only `0`, `false`, `no`, `off`, `nej` or `fra` remove it. +Setting `CMCP_BACKGROUND` locks the screen out entirely. `CMCP_BACKGROUND=0` gives you those too - and a typo will not turn it off, only `0`, `false`, `no` or `off`. `CMCP_MODE=ask` puts one consent question per session in front of the first write, and `CMCP_MODE=readonly` leaves you the fourteen that only look. @@ -396,7 +401,8 @@ all this product puts on your screen, and neither ever takes focus. Mac's password) every time. The answer travels back down the same socket connection the question came in on, bound to a one-time number with a deadline. A late answer, a different number, - or a yes without your fingerprint is a no. + or a yes without your fingerprint is a no. The one exception is the screen loan + on a server you set to `CMCP_SCREEN_ASK=0`, which is lent without a question. - **You see the whole action before you allow it.** The full text sits in the submenu, wrapped, right above `Allow…` - up to 4,000 characters. Anything longer is not asked at all: a yes has to cover everything you saw. From 6efab5a391117a2b5ed580208ab9692d8c568ac4 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Mon, 2 Nov 2026 02:58:37 +0100 Subject: [PATCH 24/94] Panel R2 (Astra, MAALT): serveren stopper sine inputhjaelpere, naar den faar SIGTERM En server der fik SIGTERM midt i et skridt, lod hjaelperen skrive videre - ogsaa efter at skaermlaanet var givet videre. exit-handleren kalder nu afbrydSkaermKald (SIGTERM til skrivende hjaelpere, SIGUSR1 til paste). Proeve 15 i skaerm-laan.mjs: roed foer rettelsen (hjaelperen levede), groen efter. Co-Authored-By: Claude Opus 5.5 --- mcp-server/index.js | 4 ++++ test/skaerm-laan.mjs | 22 +++++++++++++++++++++- 2 files changed, 25 insertions(+), 1 deletion(-) diff --git a/mcp-server/index.js b/mcp-server/index.js index bc9514d9..7f71f8a2 100644 --- a/mcp-server/index.js +++ b/mcp-server/index.js @@ -321,6 +321,10 @@ let optagelse = null; // sekunder) kan den ikke vente paa; det staar i linjen. En server der draebes med // SIGKILL kan intet skrive, og det siger docs. process.on('exit', () => { + // ⛔ R2 (Astra, MAALT 2/11 i skaerm-laan 15): en server der fik SIGTERM midt i et skridt, lod sin inputhjaelper + // skrive videre - ogsaa efter at skaermlaanet var givet til den naeste agent. Nu faar hver skrivende hjaelper + // besked (SIGTERM: slip knap/tast og gaa; paste: SIGUSR1, laeg udklipsholderen tilbage), foer serveren gaar. + try { afbrydSkaermKald(); } catch { /* intet at goere i en exit-handler */ } const o = optagelse; if (!o || o.slut) return; try { o.barn.kill('SIGINT'); } catch { /* allerede vaek */ } diff --git a/test/skaerm-laan.mjs b/test/skaerm-laan.mjs index 5cd748af..f494fc92 100644 --- a/test/skaerm-laan.mjs +++ b/test/skaerm-laan.mjs @@ -12,7 +12,7 @@ import './ryd-op.mjs'; import './egen-tilstand.mjs'; import { createServer } from 'node:net'; -import { spawn } from 'node:child_process'; +import { spawn, execFileSync } from 'node:child_process'; import { mkdtempSync, mkdirSync, writeFileSync, unlinkSync, readFileSync } from 'node:fs'; import { tmpdir } from 'node:os'; import { join, dirname } from 'node:path'; @@ -483,6 +483,26 @@ for (const [navn, ekstra, uden] of [['uden kontakten', {}, false], ['tastefejl } finally { A.srv.kill(); } } +// 15 (panel R2, Astra): en server der faar SIGTERM midt i et skridt, stopper sine inputhjaelpere foer den gaar - ellers +// kan den gamle hjaelper skrive videre, mens skaermen allerede er givet til den naeste agent. +{ + const st = mkdtempSync(join(tmpdir(), 'cmcp-laan-exit-')); + const X = server(st, HJ, {}); + try { + await X.klar(); + saet({ idle: { idle: 30 }, type: { _vent: 8000, typed: 1 } }); + const kald = X.kald('computer_type', { app: 'TextEdit', text: 'x' }).catch(() => null); + const lever = () => { try { return execFileSync('/usr/bin/pgrep', ['-f', `${dirname(HJ.sti)}/[^ ]+ type`]).toString().trim().split('\n').filter(Boolean).length; } catch { return 0; } }; + let foer = 0; for (let i = 0; i < 30 && !foer; i++) { await vent(100); foer = lever(); } + X.srv.kill('SIGTERM'); + await vent(700); + const efter = lever(); + check('15 forudsaetning: skridtet koerte (hjaelperen levede)', foer >= 1, `${foer}`); + check('15 serveren faar SIGTERM midt i et skridt: dens hjaelper er stoppet foer den naeste kan begynde', foer >= 1 && efter === 0, `foer ${foer} · efter ${efter}`); + void kald; + } finally { try { X.srv.kill('SIGKILL'); } catch {} saet({ idle: { idle: 30 } }); } +} + // 14c (panel R1, Opus): uden spoergsmaal er en udloebet ventetid i koeen IKKE et menneskes nej - svaret maa ikke sige // «do not ask again», men «nobody said no - ask again». To servere med kontakten, falsk ikon i koe-tilstand. { From 84cc99dec865a2889efaca2e1b20ff6b79e39a50 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Mon, 2 Nov 2026 03:13:24 +0100 Subject: [PATCH 25/94] Panel R2 (Astra + Opus): tag-tilbage er et stop, tavshed vises aerligt, spaerringen holder paa tvaers af genstart MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - tager mennesket skaermen (laanet slutter foer tid uden at agenten gav det tilbage): afvist i 2 min med «stop og sig det i chatten», et ventende skridt svarer det samme (ikke «call it again»), og agentens naeste laan SPOERGER - et laan uden spoergsmaal der venter: kun Deny i menu og boks, og serverens tekst siger at tavshed giver skaermen (ikke «If you allow it») - spaerringsfilen: opstartens id + monoton frist, hoejst pausen, ulaeselig = fuld spaerring (falder lukket); anden opstart = ingen spaerring - overdragelsespausen 8 s (2 s stop + 5 s noedslip) og ogsaa efter ikonets start - kontrakter paa kaldestederne (Opus M1/M2), regex-escaping i proevens hjaelper - README, CHANGELOG, server.json (CMCP_SCREEN_ASK) efter koden Proever: skaerm-laan 16 + scope, ikon-menu 3g/3h, ikon-boks 5z. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 19 +++++++---- README.md | 15 +++++---- helper/Sources/cmcp-status/Tekst.swift | 44 ++++++++++++++++++-------- helper/Sources/cmcp-status/main.swift | 20 +++++++++--- mcp-server/README.md | 15 +++++---- mcp-server/godkend.js | 5 ++- mcp-server/index.js | 29 ++++++++++++++--- server.json | 7 ++++ test/ikon-boks.mjs | 7 +++- test/ikon-menu.mjs | 34 ++++++++++++++++---- test/skaerm-laan.mjs | 29 +++++++++++++++++ 11 files changed, 174 insertions(+), 50 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c7fc7965..2fbd10d4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,13 +7,18 @@ was written down; where a claim has a test, the test is named. **The screen without a question, if you want it.** Set `CMCP_SCREEN_ASK=0` and an agent that needs the screen borrows it with no question and no Touch ID - at once, or -three seconds after another agent's loan ends, so the one before has stopped. It is -still the same loan: one agent at a time, each step waits while you use the keyboard -or mouse, and `Take the screen back now`, Esc or `⌃⌥⌘.` take it back. After that the -agent is told to stop and ask you in the chat, and no agent gets the screen without a -question for two minutes - measured on a clock that does not jump, and kept if the -menu bar icon restarts. A typo keeps the question. The audit log says whether you were -asked. (`test/skaerm-laan.mjs` 14 + 14b, `test/ikon-menu.mjs` 3f + 3g) +eight seconds after another agent's loan ends, so the one before has had time to stop +(a server killed outright can still leave a helper running: known limit). While it +waits, the box offers only `Deny`. It is still the same loan: one agent at a time per +menu bar icon, each step waits while you use the keyboard or mouse, and `Take the +screen back now` takes it back - so do Esc and `⌃⌥⌘.` when the icon could register +them. Take it back, and that agent is refused for two minutes with the words to stop +and tell you in the chat, and its next loan asks you; no agent gets the screen without +a question for those two minutes - on a clock that does not jump, and kept if the menu +bar icon restarts (not across a restart of the Mac). A server that is ended mid-step +now stops its helpers first. A typo keeps the question. The audit log says whether +you were asked. (`test/skaerm-laan.mjs` 14-16, `test/ikon-menu.mjs` 3f-3h, +`test/ikon-boks.mjs` 5z) **A stop lets go of the mouse button and starts nothing new.** A drag holds the button down for up to a few seconds, and a click or a key is down for a moment. diff --git a/README.md b/README.md index 3b81694e..b4d63150 100644 --- a/README.md +++ b/README.md @@ -253,12 +253,15 @@ now` ends the loan at once and stops a step that is still running. That button stays in the box for as long as the loan lasts - also when the agent is quiet and when you have switched the box off - and it never asks for Touch ID. If you would rather not be asked at all, set `CMCP_SCREEN_ASK=0` for the server: an agent that needs the screen then gets it -with no question and no Touch ID - at once, or a few seconds after another agent's loan ends. The -rest of the loan is the same: one agent at a time (per menu bar icon), each step waits while you are -using the keyboard or mouse, the box shows who has it with `Take the screen back now`, and while the -loan lasts Esc is your stop key too (when the icon could register it). Take it back, and that agent -is told to stop and ask you in the chat; no agent gets the screen without a question for two minutes, -also if the icon restarts. The switch is the server's own configuration: anything that can set it, or +with no question and no Touch ID - at once, or eight seconds after another agent's loan ends, so the +one before has had time to stop. While it waits for its turn, the box offers only `Deny`: say +nothing, and it gets the screen when it is free. The rest of the loan is the same: one agent at a +time (per menu bar icon), each step waits while you are using the keyboard or mouse, the box shows +who has it with `Take the screen back now`, and while the loan lasts Esc is your stop key too (when +the icon could register it). Take it back, and that agent is refused the screen for two minutes and +told to stop and tell you in the chat - and its next loan asks you, with Touch ID. No agent gets the +screen without a question for two minutes after you take it back, also if the icon restarts (not +across a restart of the Mac). The switch is the server's own configuration: anything that can set it, or talk to the icon as you, can borrow the screen - just as `CMCP_BACKGROUND=0` already hands over the foreground. A typo keeps the question; only `0`, `false`, `no`, `off`, `nej` or `fra` remove it. Setting `CMCP_BACKGROUND` locks the screen out entirely. `CMCP_BACKGROUND=0` diff --git a/helper/Sources/cmcp-status/Tekst.swift b/helper/Sources/cmcp-status/Tekst.swift index 66b4e02f..6e5961bf 100644 --- a/helper/Sources/cmcp-status/Tekst.swift +++ b/helper/Sources/cmcp-status/Tekst.swift @@ -173,10 +173,13 @@ func touchIdUdfald(ok: Bool, erLaan: Bool) -> TouchIdUdfald { ok && erLaan ? .la /// 2/11: efter «tag tilbage» / «stop alle» faar ingen agent skaermen uden spoergsmaal i saa mange sekunder. let STAAENDE_PAUSE: Double = 120 -/// R1 (Astra P1): et nyt laan uden spoergsmaal gives tidligst saa mange sekunder efter at det forrige sluttede - den -/// forrige agents hjaelpere faar SIGTERM, og SIGKILL 2 s efter (helper.js draebBlidt), foer den naeste maa begynde. -let OVERDRAG_PAUSE: Double = 3 -/// R1 (Astra P1): spaerringen gemmes her (vaegur, ms), saa den overlever at ikonet genstartes. +/// R1/R2 (Astra P1): et nyt laan uden spoergsmaal gives tidligst saa mange sekunder efter at det forrige sluttede (og efter +/// at ikonet selv startede). Den forrige agents hjaelpere faar SIGTERM og SIGKILL 2 s efter, og et traek der hang, slippes af +/// en ny hjaelper med 5 s frist (helper.js draebBlidt) - 8 s daekker begge. En pause, ikke en kvittering: en server der draebes +/// med SIGKILL, kan efterlade en hjaelper (kendt graense). +let OVERDRAG_PAUSE: Double = 8 +/// R1/R2 (Astra P1): spaerringen gemmes her med opstartens id og en MONOTON frist, saa hverken en genstart af ikonet eller et +/// vaegur der springer, loefter den. let SPAERRING_FIL = "skaerm-spaerret.json" /// 2/11: gives denne anmodning skaermen STRAKS uden spoergsmaal? Kun et skaerm-laan, kun naar serveren bad om det @@ -191,15 +194,30 @@ func giverUdenSpoergsmaal(kind: String?, ask: Bool?, andetLaanAktivt: Bool, spae return true } -/// Spaerringen i SPAERRING_FIL (`{"until": }`) -> sekunder tilbage, eller nil. En vaerdi laengere fremme end -/// pausen (et ur der er sprunget, en fil fra foer en genstart af Mac'en) er ugyldig og laaser ikke for evigt. -func spaerringTilbage(filTekst: String?, nuMs: Double) -> Double? { - guard let t = filTekst, let d = t.data(using: .utf8), - let o = try? JSONSerialization.jsonObject(with: d) as? [String: Any], - let til = (o["until"] as? Double) ?? (o["until"] as? Int).map(Double.init) else { return nil } - let rest = (til - nuMs) / 1000 - guard rest > 0, rest <= STAAENDE_PAUSE + 1 else { return nil } - return rest +/// Hvornaar Mac'en startede (kern.boottime, sekunder) - opstartens id. 0 hvis den ikke kan laeses. +func bootTid() -> Int { + var tv = timeval(); var stoerrelse = MemoryLayout.stride; var mib: [Int32] = [CTL_KERN, KERN_BOOTTIME] + guard sysctl(&mib, 2, &tv, &stoerrelse, nil, 0) == 0 else { return 0 } + return Int(tv.tv_sec) +} + +/// Linjen i SPAERRING_FIL: opstartens id + den monotone frist (systemUptime) + vaeguret til mennesker der laeser filen. +func spaerringJSON(boot: Int, uptimeTil: Double, vaegMs: Double) -> String { + "{\"boot\":\(boot),\"uptimeUntil\":\(uptimeTil),\"until\":\(Int(vaegMs))}\n" +} + +/// Spaerringen i SPAERRING_FIL -> sekunder tilbage, eller nil. R2 (Astra P1, Opus): samme opstart -> den monotone frist, +/// hoejst STAAENDE_PAUSE (falder LUKKET); en anden opstart -> ingen spaerring (en genstart af Mac'en afslutter alle laan); +/// en fil der ikke kan laeses -> hele pausen (falder lukket). +func spaerringTilbage(filTekst: String?, boot: Int, oppetid: Double) -> Double? { + guard let t = filTekst else { return nil } + guard let d = t.data(using: .utf8), let o = try? JSONSerialization.jsonObject(with: d) as? [String: Any], + let b = (o["boot"] as? Int) ?? (o["boot"] as? Double).map({ Int($0) }), + let til = (o["uptimeUntil"] as? Double) ?? (o["uptimeUntil"] as? Int).map(Double.init) else { return STAAENDE_PAUSE } + guard b == boot, boot != 0 else { return nil } + let rest = til - oppetid + guard rest > 0 else { return nil } + return min(rest, STAAENDE_PAUSE) } enum BoksHandling: Equatable { case foelg, tagTilbage, stopAlle, tillad(String), afvis(String), gjort(String), hentFrem(String), intet } diff --git a/helper/Sources/cmcp-status/main.swift b/helper/Sources/cmcp-status/main.swift index 71200b2c..49694dc2 100644 --- a/helper/Sources/cmcp-status/main.swift +++ b/helper/Sources/cmcp-status/main.swift @@ -527,6 +527,9 @@ func spoergsmaalMenu(_ s: Spoergsmaal, aktivtAndetLaan: (klient: String?, til: D var knapper: [String] if s.kind == "goer-selv" { knapper = (s.targetBundle != nil ? ["Take me there"] : []) + ["Done — I did it", "I won't do this"] + } else if s.kind == "screen" && s.ask == false { + // R2 (Opus 🔴): et laan uden spoergsmaal vises ALDRIG med Allow - tavshed giver skaermen, saa kun Deny staar. + knapper = ["Deny"] } else { knapper = ["Allow… (confirm with Touch ID)", "Deny"] } @@ -583,7 +586,10 @@ if CommandLine.arguments.contains("--dump-question") { // SPAERRING_FIL i tilstandsmappen laeses som ved ikonets start (R1: den overlever en genstart). let nu = oppetid() var spaerret: Double? = spaerringTilbage(filTekst: try? String(contentsOfFile: (stateDir as NSString).appendingPathComponent(SPAERRING_FIL), encoding: .utf8), - nuMs: Date().timeIntervalSince1970 * 1000).map { nu + $0 } + boot: bootTid(), oppetid: nu).map { nu + $0 } + // R2: uret og opstarten, saa proeven kan skrive en gyldig fil - og en rundtur skriver -> laeser. + ud["clock"] = ["boot": bootTid(), "uptime": nu] + ud["blockFileRoundTrip"] = spaerringTilbage(filTekst: spaerringJSON(boot: bootTid(), uptimeTil: nu + 60, vaegMs: 0), boot: bootTid(), oppetid: nu) ?? -1 var ledig: Double? = nil if let raw = try? JSONSerialization.jsonObject(with: raa) as? [String: Any] { if let siden = (raw["simulateTakenBackSecondsAgo"] as? Double) ?? (raw["simulateTakenBackSecondsAgo"] as? Int).map(Double.init) { @@ -593,6 +599,7 @@ if CommandLine.arguments.contains("--dump-question") { ledig = nu + OVERDRAG_PAUSE - siden } } + ud["standingBlockedSeconds"] = max(0, (spaerret ?? nu) - nu) ud["lendsWithoutAsking"] = giverUdenSpoergsmaal(kind: s.kind, ask: s.ask, andetLaanAktivt: aktivtAndetLaan != nil, spaerretTil: spaerret, ledigFra: ledig, nu: nu) if s.kind == "screen" { @@ -1107,9 +1114,9 @@ final class Ikon: NSObject, NSMenuDelegate, UNUserNotificationCenterDelegate { /// Saettes foer tik() i samme tur paa hovedtraaden; tik() (hvert sekund) giver det ventende laan, naar den udloeber. func spaerStaaende() { staaendeSpaerretTil = oppetid() + STAAENDE_PAUSE - // R1 (Astra P1): gemt, saa et ikon der genstarter inden for pausen, ogsaa holder den. Fejler skrivningen, holder - // spaerringen stadig i denne proces - og det noteres. - let post = "{\"until\":\(Int(Date().timeIntervalSince1970 * 1000 + STAAENDE_PAUSE * 1000))}\n" + // R1/R2 (Astra P1): gemt med opstartens id og den monotone frist, saa et ikon der genstarter inden for pausen, ogsaa + // holder den. Fejler skrivningen, holder spaerringen stadig i denne proces - og det noteres. + let post = spaerringJSON(boot: bootTid(), uptimeTil: staaendeSpaerretTil ?? 0, vaegMs: Date().timeIntervalSince1970 * 1000 + STAAENDE_PAUSE * 1000) do { try post.write(toFile: (stateDir as NSString).appendingPathComponent(SPAERRING_FIL), atomically: true, encoding: .utf8) } catch { noterKilde("standing-block-write-failed") } } @@ -1290,8 +1297,11 @@ genveje.vedEsc = { ikon.stopAlleNu(kilde: "stop-all-esc-loan") } nyAnmodning = { a in ikon.vis(a) } // R1 (Astra P1): en spaerring fra et tidligere ikon (genstartet inden for pausen) gaelder stadig. if let rest = spaerringTilbage(filTekst: try? String(contentsOfFile: (stateDir as NSString).appendingPathComponent(SPAERRING_FIL), encoding: .utf8), - nuMs: Date().timeIntervalSince1970 * 1000) { + boot: bootTid(), oppetid: oppetid()) { staaendeSpaerretTil = oppetid() + rest } +// R2 (Astra): et ikon der lige er startet (maaske fordi det forrige doede midt i et laan), giver intet laan uden spoergsmaal +// foer OVERDRAG_PAUSE - den forrige agents hjaelpere skal have tid til at stoppe. +laanLedigFra = oppetid() + OVERDRAG_PAUSE laanOpdateret = { genveje.laan(aktivtLaan.map { !$0.lukket } ?? false); ikon.tik() } app.run() diff --git a/mcp-server/README.md b/mcp-server/README.md index 2aece51b..82b00e7f 100644 --- a/mcp-server/README.md +++ b/mcp-server/README.md @@ -251,12 +251,15 @@ now` ends the loan at once and stops a step that is still running. That button stays in the box for as long as the loan lasts - also when the agent is quiet and when you have switched the box off - and it never asks for Touch ID. If you would rather not be asked at all, set `CMCP_SCREEN_ASK=0` for the server: an agent that needs the screen then gets it -with no question and no Touch ID - at once, or a few seconds after another agent's loan ends. The -rest of the loan is the same: one agent at a time (per menu bar icon), each step waits while you are -using the keyboard or mouse, the box shows who has it with `Take the screen back now`, and while the -loan lasts Esc is your stop key too (when the icon could register it). Take it back, and that agent -is told to stop and ask you in the chat; no agent gets the screen without a question for two minutes, -also if the icon restarts. The switch is the server's own configuration: anything that can set it, or +with no question and no Touch ID - at once, or eight seconds after another agent's loan ends, so the +one before has had time to stop. While it waits for its turn, the box offers only `Deny`: say +nothing, and it gets the screen when it is free. The rest of the loan is the same: one agent at a +time (per menu bar icon), each step waits while you are using the keyboard or mouse, the box shows +who has it with `Take the screen back now`, and while the loan lasts Esc is your stop key too (when +the icon could register it). Take it back, and that agent is refused the screen for two minutes and +told to stop and tell you in the chat - and its next loan asks you, with Touch ID. No agent gets the +screen without a question for two minutes after you take it back, also if the icon restarts (not +across a restart of the Mac). The switch is the server's own configuration: anything that can set it, or talk to the icon as you, can borrow the screen - just as `CMCP_BACKGROUND=0` already hands over the foreground. A typo keeps the question; only `0`, `false`, `no`, `off`, `nej` or `fra` remove it. Setting `CMCP_BACKGROUND` locks the screen out entirely. `CMCP_BACKGROUND=0` diff --git a/mcp-server/godkend.js b/mcp-server/godkend.js index f132c6ef..f5815e12 100644 --- a/mcp-server/godkend.js +++ b/mcp-server/godkend.js @@ -206,7 +206,10 @@ export async function laanSkaermen({ session, client, text, minutter, spoerg = t sock.on('connect', () => { sock.write(JSON.stringify({ nonce, session, client: ren(client).slice(0, 200), text: helTekst, - scope: `If you allow it, the agent may use your screen for ${minutter} minutes: move the pointer, type into the app in front and bring windows forward. Before each step it waits if you are using the keyboard or mouse; a step already running finishes, or stops at once when you take the screen back. Password apps, deletions, and messages in the apps and web chats it recognises still ask. Take the screen back at any time with Take the screen back now, in the box in the corner of your screen or in this menu.`, + scope: spoerg + ? `If you allow it, the agent may use your screen for ${minutter} minutes: move the pointer, type into the app in front and bring windows forward. Before each step it waits if you are using the keyboard or mouse; a step already running finishes, or stops at once when you take the screen back. Password apps, deletions, and messages in the apps and web chats it recognises still ask. Take the screen back at any time with Take the screen back now, in the box in the corner of your screen or in this menu.` + // R2 (Opus 🔴): uden spoergsmaal giver tavshed skaermen - sig det, og sig at Deny er nej. + : `This agent gets your screen without a question as soon as it is free (you set CMCP_SCREEN_ASK=0), for ${minutter} minutes: it may move the pointer, type into the app in front and bring windows forward. Press Deny to refuse. Before each step it waits if you are using the keyboard or mouse. Password apps, deletions, and messages in the apps and web chats it recognises still ask. Take the screen back at any time with Take the screen back now.`, target: 'your screen', kind: 'screen', minutes: minutter, expires: frist, // 2/11: kun naar mennesket har slaaet spoergsmaalet fra (CMCP_SCREEN_ASK=0). Et ikon der ikke kender feltet, // spoerger som foer - og svarer «owner», som ogsaa godtages. diff --git a/mcp-server/index.js b/mcp-server/index.js index 7f71f8a2..eb7ef860 100644 --- a/mcp-server/index.js +++ b/mcp-server/index.js @@ -400,6 +400,12 @@ function klientOmveje() { let laanHaandtag = null; let laanNr = 0; let laanAfgivet = false; +// R2 (Opus 🔴 + Astra): hvornaar mennesket sidst tog skaermen fra DENNE agent (0 = aldrig). Et stop skal naa agenten som et stop. +let tagetTilbageVed = 0; +const TILBAGE_PAUSE_MS = 120_000; +const TILBAGE_STOP = 'Stop, and tell them in the chat what you were doing - do not request the screen again by yourself.'; +// Kun uden spoergsmaal: med spoergsmaalet afgoer mennesket hvert laan selv, og intet aendres dér. +const nyligtTagetTilbage = () => skaermUdenSpoergsmaal() && tagetTilbageVed > 0 && Date.now() - tagetTilbageVed < TILBAGE_PAUSE_MS; const POSTER_INPUT = new Set(['computer_click', 'computer_move', 'computer_drag', 'computer_scroll', 'computer_type', 'computer_key', 'computer_paste', 'computer_space']); // agenten gav selv skaermen tilbage (en loglinje, ikke to) // hvert laan sit nummer: et gammelt laans slut roerer ikke et nyt let sidsteEgenHandling = 0; const klientNavn = () => server.getClientVersion?.()?.name || process.env.CMCP_CLIENT || null; @@ -462,18 +468,28 @@ async function skaermLaan(args) { let nr = null, lukketFoerStart = false; const min = Math.max(1, Math.min(15, Number.isInteger(args.minutes) ? args.minutes : 10)); // 2/11: CMCP_SCREEN_ASK=0 - ikonet giver laanet uden at spoerge (se skaermUdenSpoergsmaal i policy.js). - const spoerg = !skaermUdenSpoergsmaal(); + // R2: har mennesket taget skaermen fra denne agent, er det et STOP: afvist i to minutter, og bagefter SPOERGES der + // (Touch ID) - mennesket greb ind, saa det er dem, der afgoer det naeste laan. + if (nyligtTagetTilbage()) { + log('denied', 'the person took the screen back from this agent less than two minutes ago'); + return errorResult(`Refused: the person took the screen back from this agent less than two minutes ago. ${TILBAGE_STOP}`); + } + const spoerg = !skaermUdenSpoergsmaal() || tagetTilbageVed > 0; const svar = await laanSkaermen({ session: SESSION, client: klientNavn(), text: laanTekst, minutter: min, spoerg }, skaermVentetid(), async () => { // Forbindelsen er lukket: tiden gik, mennesket tog skaermen, ikonet doede, // eller agenten gav den tilbage. Kun DETTE laans slut taeller. if (nr === null) { lukketFoerStart = true; return; } if (nr !== laanNr) return; + // R2: sluttede laanet foer tid, og ikke fordi agenten gav det tilbage, tog mennesket det (eller ikonet lukkede). + const plan = laanTilTid(); + const tagetTilbage = !laanAfgivet && plan > 0 && Date.now() < plan - 1500; + if (tagetTilbage) tagetTilbageVed = Date.now(); saetLaan(0); laanHaandtag = null; // ⛔ Runde 1 (Astra 4): et traek eller en skrivning der er i gang, stoppes. const stoppet = afbrydSkaermKald(); record({ tool: 'computer_request_screen', outcome: 'ended', - reason: laanAfgivet ? 'the agent handed the screen back' : 'the screen went back to the person', ...(stoppet ? { stopped: stoppet } : {}) }); + reason: laanAfgivet ? 'the agent handed the screen back' : tagetTilbage ? 'the person took the screen back (or the menu bar icon closed) before the loan ran out' : 'the screen went back to the person', ...(stoppet ? { stopped: stoppet } : {}) }); await meldListe(); }); // ⛔ R42 (Astra, MAALT): et afbrudt kald fik laanet, da mennesket sagde ja bagefter. Kom ja'et efter @@ -1868,7 +1884,9 @@ async function haandterKald(request) { `In background mode the server never moves the pointer, sends a key press, ` + `brings an app forward, switches desktop, or raises a dialog of its own.\n` + `If this step genuinely needs the screen, ask the person to lend it to you with ` + - (skaermUdenSpoergsmaal() + (nyligtTagetTilbage() + ? `computer_request_screen - but the person took the screen back from this agent less than two minutes ago. ${TILBAGE_STOP}\n` + : skaermUdenSpoergsmaal() && !tagetTilbageVed ? `computer_request_screen - this server borrows it without a question (CMCP_SCREEN_ASK=0), for a few minutes.\n` : `computer_request_screen - they approve it in the box in the corner of their screen (or the menu bar), for a few minutes.\n`) + `Otherwise use the quiet route: computer_find to locate the element, then ` + @@ -2070,6 +2088,7 @@ async function haandterKald(request) { } }; let stopVenter = false; // R42: stoppet fordi mennesket er der (eller ukendt) - «Waiting», ikke et afslag + let stopTilbage = false; // R2: mennesket tog skaermen tilbage, mens skridtet ventede - et STOP, ikke «call it again» const maalErStadigForsvarligt = async () => { // (Runde 1, Astra 4: «laanet sluttede mens kaldet ventede» haandhaeves nu af // laanVedDom lige foer handlingen - én vagt for alle skrivende kald.) @@ -2253,7 +2272,8 @@ async function haandterKald(request) { return null; } if (laanOejeblik() !== laanVedDom) { - stopgrund = 'the screen loan changed while this waited (it began, ended or was taken back), so it was not done - call it again'; + if (nyligtTagetTilbage()) { stopTilbage = true; stopgrund = 'the person took the screen back while this waited, so it was not done'; } + else stopgrund = 'the screen loan changed while this waited (it began or ran out), so it was not done - call it again'; return null; } // Runde 2 (Astra 5): kun handlinger der POSTER input flytter stemplet - efter et @@ -2269,6 +2289,7 @@ async function haandterKald(request) { target: targetBundleId, decision: stopVenter ? 'waiting' : 'denied', asked: verdict.asked, ...(verdict.asker === 'menubar' ? { asker: 'menubar' } : {}), reason: stopgrund }); if (kaldStoppet()) return errorResult(`Stopped: ${stopgrund}. Ask them in the chat before you continue.`); + if (stopTilbage) return errorResult(`Refused: ${stopgrund}. Nothing was done. ${TILBAGE_STOP}`); return errorResult(`${stopVenter ? 'Waiting' : 'Refused'}: ${stopgrund}. Nothing was done. Call it again.`); } if (!laast.ok) { diff --git a/server.json b/server.json index 180e7f63..c4d7f716 100644 --- a/server.json +++ b/server.json @@ -32,6 +32,13 @@ "isSecret": false, "format": "string" }, + { + "name": "CMCP_SCREEN_ASK", + "description": "0 = lend the screen to an agent without a question or Touch ID (one agent at a time; each step still waits while you use the keyboard or mouse; Take the screen back now still works). Default: ask.", + "isRequired": false, + "isSecret": false, + "format": "string" + }, { "name": "CMCP_CLIENT", "description": "A name for this server in the audit log, so several agents on one Mac can be told apart.", diff --git a/test/ikon-boks.mjs b/test/ikon-boks.mjs index f847091b..c19f3a4e 100644 --- a/test/ikon-boks.mjs +++ b/test/ikon-boks.mjs @@ -257,7 +257,7 @@ const tikKrop = krop('func tik() {'); { const giv = krop('func givStaaendeLaan('), tilbage = krop('func tagTilbageNu('), stopA = krop('func stopAlleNu('), spaer = krop('func spaerStaaende('); // Et KALD paa sin egen linje - ikke teksten i en kommentar (MB1 overlevede, da «// spaerStaaende()» matchede). - const kald = (t, x) => { const r = new RegExp('\\n[ \\t]+' + x.replace(/[()]/g, '\\$&')); const mm = r.exec(t); return mm ? mm.index : -1; }; + const kald = (t, x) => { const r = new RegExp('\\n[ \\t]+' + x.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')); const mm = r.exec(t); return mm ? mm.index : -1; }; const foer = (t, a, b) => kald(t, a) >= 0 && kald(t, b) > kald(t, a); check('5z et laan uden spoergsmaal goer Esc til stoptast (laanOpdateret efter at laanet er sat)', foer(giv, 'aktivtLaan = a; laanTil = til', 'laanOpdateret()') && /verified: "standing"/.test(giv), giv.slice(0, 160)); @@ -266,6 +266,11 @@ const tikKrop = krop('func tik() {'); `${tilbage.slice(0, 120)} · ${stopA.slice(0, 120)}`); check('5z spaerringen gemmes i SPAERRING_FIL og laeses ved start', /appendingPathComponent\(SPAERRING_FIL\)/.test(spaer) && /staaendeSpaerretTil = oppetid\(\) \+ STAAENDE_PAUSE/.test(spaer) && /if let rest = spaerringTilbage\([\s\S]{0,320}\{\n\s+staaendeSpaerretTil = oppetid\(\) \+ rest/.test(m)); + // R2 (Opus M1/M2 overlevede): KALDESTEDET bruger spaerringen og pausen, og skriveren gemmer den rigtige frist. + check('5z givStaaendeLaan bruger spaerringen OG overdragelsespausen (ikke nil)', /spaerretTil: staaendeSpaerretTil, ledigFra: laanLedigFra, nu: nu\)/.test(giv), giv.slice(0, 200)); + check('5z spaerStaaende gemmer den monotone frist, den lige har sat (ikke en udloebet)', + kald(spaer, 'staaendeSpaerretTil = oppetid() + STAAENDE_PAUSE') >= 0 && /spaerringJSON\(boot: bootTid\(\), uptimeTil: staaendeSpaerretTil \?\? 0,/.test(spaer), spaer.slice(0, 200)); + check('5z et nystartet ikon giver tidligst et laan uden spoergsmaal efter OVERDRAG_PAUSE', /\nlaanLedigFra = oppetid\(\) \+ OVERDRAG_PAUSE/.test(m)); check('5z et laan der slutter, giver tidligst det naeste efter OVERDRAG_PAUSE', /if aktivtLaan === a \{ laanLedigFra = oppetid\(\) \+ OVERDRAG_PAUSE; aktivtLaan = nil/.test(m)); } check('5r synligheden (R24, adfaerd): et laan holder boksen fremme uanset alt; ellers kun naar nogen arbejder, der er sessioner, og boksen ikke er slaaet fra', diff --git a/test/ikon-menu.mjs b/test/ikon-menu.mjs index d0235644..da2ca3d9 100644 --- a/test/ikon-menu.mjs +++ b/test/ikon-menu.mjs @@ -91,15 +91,35 @@ check('3f ask:false 130 s efter: gives igen', vis({ ...lan, ask: false, simulate // faar SIGKILL 2 s efter SIGTERM (helper.js draebBlidt); (b) spaerringen efter «tag tilbage» overlever at ikonet // genstartes: den laeses fra skaerm-spaerret.json i tilstandsmappen, og en vaerdi laengere fremme end pausen er ugyldig. check('3g et laan sluttede for 1 s siden: den naeste venter', vis({ ...lan, ask: false, simulateLoanEndedSecondsAgo: 1 }).lendsWithoutAsking === false); -check('3g ...for 4 s siden: gives', vis({ ...lan, ask: false, simulateLoanEndedSecondsAgo: 4 }).lendsWithoutAsking === true); +check('3g ...for 7 s siden: venter stadig (pausen er 8 s: 2 s stop + 5 s noedslip af et traek)', vis({ ...lan, ask: false, simulateLoanEndedSecondsAgo: 7 }).lendsWithoutAsking === false); +check('3g ...for 9 s siden: gives', vis({ ...lan, ask: false, simulateLoanEndedSecondsAgo: 9 }).lendsWithoutAsking === true); +// R2 (Astra P1): filen baerer opstartens id + en MONOTON frist; skriver -> laeser er samme format (rundtur). +const ur = vis({ ...lan, ask: false }).clock || {}; +check('3g instrument: ikonet oplyser opstart og oppetid', ur.boot > 0 && ur.uptime > 0, JSON.stringify(ur)); +check('3g rundtur: skriverens linje laeses tilbage som ca. 60 s', Math.abs(vis(lan).blockFileRoundTrip - 60) < 2, String(vis(lan).blockFileRoundTrip)); const SPF = join(STATE, 'skaerm-spaerret.json'); -writeFileSync(SPF, JSON.stringify({ until: Date.now() + 60_000 })); -check('3g spaerringen fra et tidligere ikon (60 s tilbage) gaelder efter genstart', vis({ ...lan, ask: false }).lendsWithoutAsking === false); -writeFileSync(SPF, JSON.stringify({ until: Date.now() - 1000 })); -check('3g ...en udloebet spaerring i filen: gives', vis({ ...lan, ask: false }).lendsWithoutAsking === true); -writeFileSync(SPF, JSON.stringify({ until: Date.now() + 10 * 86_400_000 })); -check('3g ...en spaerring 10 dage frem (ugyldig) laaser ikke for evigt', vis({ ...lan, ask: false }).lendsWithoutAsking === true); +const skriv = (o) => writeFileSync(SPF, typeof o === 'string' ? o : JSON.stringify(o)); +const nuUr = () => vis({ ...lan, ask: false }).clock; +let c = nuUr(); skriv({ boot: c.boot, uptimeUntil: c.uptime + 60 }); +check('3g spaerringen fra et tidligere ikon (60 s tilbage, samme opstart) gaelder efter genstart', vis({ ...lan, ask: false }).lendsWithoutAsking === false); +c = nuUr(); skriv({ boot: c.boot, uptimeUntil: c.uptime - 1 }); +check('3g ...udloebet (samme opstart): gives', vis({ ...lan, ask: false }).lendsWithoutAsking === true); +c = nuUr(); skriv({ boot: c.boot - 1000, uptimeUntil: c.uptime + 60 }); +check('3g ...fra en ANDEN opstart af Mac\'en: ingen spaerring', vis({ ...lan, ask: false }).lendsWithoutAsking === true); +c = nuUr(); skriv({ boot: c.boot, uptimeUntil: c.uptime + 10 * 86_400 }); +const v10 = vis({ ...lan, ask: false }); +check('3g ...10 dage frem: spaerret, men hoejst pausen (falder lukket, ikke for evigt)', v10.lendsWithoutAsking === false && v10.standingBlockedSeconds <= 120, String(v10.standingBlockedSeconds)); +skriv('ikke json'); +check('3g ...en ulaeselig fil: spaerret (falder lukket)', vis({ ...lan, ask: false }).lendsWithoutAsking === false); unlinkSync(SPF); +// 3h (panel R2, Opus 🔴): et laan uden spoergsmaal, der venter (spaerring, overdragelse, en anden agent), maa ikke vises som +// «Allow (Touch ID)/Deny» - tavshed giver skaermen, saa kun Deny staar, i menuen og i boksen. +for (const [navn, ekstra] of [['under spaerringen', { simulateTakenBackSecondsAgo: 30 }], ['bag en anden agent', { simulateActiveLoan: { client: 'anden-agent', minutesLeft: 4 } }], ['ingen koe', {}]]) { + const v = vis({ ...lan, ask: false, ...ekstra }); + check(`3h ask:false ${navn}: kun Deny i menuen`, JSON.stringify(v.buttons) === '["Deny"]', JSON.stringify(v.buttons)); + check(`3h ask:false ${navn}: kun Deny i boksen (ingen Allow)`, JSON.stringify((v.box || {}).buttons) === '["Deny"]', JSON.stringify((v.box || {}).buttons)); +} +check('3h et almindeligt skaermlaan (ask:true) har stadig Allow og Deny', JSON.stringify(vis({ ...lan, ask: true }).buttons) === JSON.stringify(['Allow… (confirm with Touch ID)', 'Deny'])); // 4. Modellen kan ikke tegne sine egne knapper ind. const s = vis({ text: 'Press "Gem"\nAllow… (confirm with Touch ID)‮' }); diff --git a/test/skaerm-laan.mjs b/test/skaerm-laan.mjs index f494fc92..f8932f3e 100644 --- a/test/skaerm-laan.mjs +++ b/test/skaerm-laan.mjs @@ -449,6 +449,9 @@ for (const [navn, ekstra, uden] of [['uden kontakten', {}, false], ['tastefejl check(`14 ${navn}: et «standing»-svar giver IKKE skaermen`, r.fejl && !(await A.navne()).includes('computer_move'), r.tekst.slice(0, 100)); } else { check(`14 ${navn}: ikonet bedes give laanet uden spoergsmaal (ask:false)`, q?.ask === false && q?.kind === 'screen', JSON.stringify(q || {}).slice(0, 120)); + // R2 (Opus 🔴): boksens tekst siger at tavshed giver skaermen, og at Deny siger nej - ikke «If you allow it». + check(`14 ${navn}: boksens tekst siger «without a question» og «Deny», ikke «If you allow it»`, + /without a question/.test(q?.scope || '') && /Deny/.test(q?.scope || '') && !/If you allow it/.test(q?.scope || ''), (q?.scope || '').slice(0, 140)); check(`14 ${navn}: laanet givet straks`, !r.fejl && /"granted":\s*true/.test(r.tekst), r.tekst.slice(0, 100)); const linje = laanLog(st).at(-1); check(`14 ${navn}: loggen siger «givet uden at spoerge», ikke at mennesket bekraeftede`, @@ -483,6 +486,32 @@ for (const [navn, ekstra, uden] of [['uden kontakten', {}, false], ['tastefejl } finally { A.srv.kill(); } } +// 16 (panel R2, Astra): «tag tilbage» skal naa agenten som et STOP - et ventende skridt maa ikke svare «call it again», +// og en ny anmodning uden spoergsmaal afvises med «stop og sig det i chatten» i to minutter. +{ + const st = mkdtempSync(join(tmpdir(), 'cmcp-laan-tb-')); + const ik = await lavIkon(st); ik.svar = 'staaende'; ik.laanMs = 60_000; + const A = server(st, HJ, { CMCP_SCREEN_ASK: '0' }); + try { + await A.klar(); + saet({ idle: { idle: 30 } }); + const r = await A.kald('computer_request_screen', { action: 'request', reason: 'drag a file', minutes: 3 }); + check('16 forudsaetning: laanet givet', !r.fejl && /"granted":\s*true/.test(r.tekst), r.tekst.slice(0, 80)); + await vent(700); + saet({ idle: { idle: 0.1 } }); // mennesket bruger musen: skridtet venter + const skridt = A.kald('computer_move', { x: 9, y: 9 }); + await vent(400); + ik.laan.destroy(); // mennesket tager skaermen tilbage (ikonet lukker) + const sv = await skridt; + check('16 et skridt der ventede, da mennesket tog skaermen: «stop og sig det i chatten», ikke «call it again»', + sv.fejl && /took the screen back/.test(sv.tekst) && /do not request the screen again by yourself/.test(sv.tekst) && !/Call it again/.test(sv.tekst), sv.tekst.slice(0, 200)); + saet({ idle: { idle: 30 } }); + const igen = await A.kald('computer_request_screen', { action: 'request', reason: 'drag a file again', minutes: 3 }); + check('16 en ny anmodning lige efter: afvist med stop-beskeden, ikonet ikke spurgt igen', + igen.fejl && /took the screen back/.test(igen.tekst) && /do not request the screen again by yourself/.test(igen.tekst) && ik.spurgt.length === 1, `${igen.tekst.slice(0, 160)} · spurgt ${ik.spurgt.length}`); + } finally { A.srv.kill(); saet({ idle: { idle: 30 } }); } +} + // 15 (panel R2, Astra): en server der faar SIGTERM midt i et skridt, stopper sine inputhjaelpere foer den gaar - ellers // kan den gamle hjaelper skrive videre, mens skaermen allerede er givet til den naeste agent. { From 93a49f86c44d9fd918af62d8b06cd83cd09f3750 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Mon, 2 Nov 2026 03:41:38 +0100 Subject: [PATCH 26/94] Panel R3 (Astra): ikonet siger hvorfor, serveren venter paa sine hjaelpere, spaerringen paa en stabil opstart MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - ikonet sender {ended: taken-back|stopped-all|expired} foer det lukker et laan, og {queued:true} naar et laan uden spoergsmaal maa vente; serveren laeser linje for linje - en udloebet ventetid uden «queued» er UKENDT (et aeldre ikon kan have spurgt): asked:null og «do not ask again» - ikke «ask again» - et stop efter «tag tilbage» vinder over enhver anden afvisning i svaret; stoppet maales monotont og nulstilles, naar mennesket selv bekraefter et laan - lukkesignal (og vagten, naar klienten er vaek): stop hjaelperne og VENT - SIGKILL efter 2 s og noedslip af et traek - foer serveren gaar (stopOgVent); status.js' exit(0) erstattes - spaerringsfilen: kern.bootsessionuuid (kern.boottime flyttes med uret); en fil der findes men ikke kan laeses, og en ulaeselig opstart, falder LUKKET - husets kontrakter S4 og 5o kraever nu afslutLaan med grunden (samme kald, samme sted) Proever: skaerm-laan 14d, 15b, 16b, 16c, 16e · ikon-menu 3g · ikon-boks 5z · vagt 5c. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 4 +- helper/Sources/cmcp-status/Tekst.swift | 39 +++++++---- helper/Sources/cmcp-status/main.swift | 39 +++++++---- mcp-server/godkend.js | 63 +++++++++++------- mcp-server/helper.js | 23 ++++++- mcp-server/index.js | 29 +++++--- mcp-server/vagt.js | 4 +- test/falsk-hjaelper.mjs | 2 + test/ikon-boks.mjs | 11 +++- test/ikon-menu.mjs | 14 ++-- test/skaerm-laan.mjs | 91 +++++++++++++++++++++++++- test/stop-alle.mjs | 2 +- test/vagt.mjs | 17 +++++ 13 files changed, 271 insertions(+), 67 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2fbd10d4..79967b1e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -16,7 +16,9 @@ them. Take it back, and that agent is refused for two minutes with the words to and tell you in the chat, and its next loan asks you; no agent gets the screen without a question for those two minutes - on a clock that does not jump, and kept if the menu bar icon restarts (not across a restart of the Mac). A server that is ended mid-step -now stops its helpers first. A typo keeps the question. The audit log says whether +now stops its helpers and waits for them - two seconds, then it ends them and lets go of +a held drag - before it goes; the menu bar icon also says why a loan ended, so a take-back +in the loan's last second is still a stop. A typo keeps the question. The audit log says whether you were asked. (`test/skaerm-laan.mjs` 14-16, `test/ikon-menu.mjs` 3f-3h, `test/ikon-boks.mjs` 5z) diff --git a/helper/Sources/cmcp-status/Tekst.swift b/helper/Sources/cmcp-status/Tekst.swift index 6e5961bf..92256aaf 100644 --- a/helper/Sources/cmcp-status/Tekst.swift +++ b/helper/Sources/cmcp-status/Tekst.swift @@ -194,27 +194,40 @@ func giverUdenSpoergsmaal(kind: String?, ask: Bool?, andetLaanAktivt: Bool, spae return true } -/// Hvornaar Mac'en startede (kern.boottime, sekunder) - opstartens id. 0 hvis den ikke kan laeses. -func bootTid() -> Int { - var tv = timeval(); var stoerrelse = MemoryLayout.stride; var mib: [Int32] = [CTL_KERN, KERN_BOOTTIME] - guard sysctl(&mib, 2, &tv, &stoerrelse, nil, 0) == 0 else { return 0 } - return Int(tv.tv_sec) +/// R3 (Astra P1): opstartens id er kern.bootsessionuuid - ny for hver opstart og uroert af vaegur-justeringer +/// (kern.boottime FLYTTES, naar uret stilles - XNU clock.c). nil hvis den ikke kan laeses. +func bootSession() -> String? { + var stoerrelse = 0 + guard sysctlbyname("kern.bootsessionuuid", nil, &stoerrelse, nil, 0) == 0, stoerrelse > 1 else { return nil } + var buf = [CChar](repeating: 0, count: stoerrelse) + guard sysctlbyname("kern.bootsessionuuid", &buf, &stoerrelse, nil, 0) == 0 else { return nil } + let s = String(cString: buf) + return s.isEmpty ? nil : s } /// Linjen i SPAERRING_FIL: opstartens id + den monotone frist (systemUptime) + vaeguret til mennesker der laeser filen. -func spaerringJSON(boot: Int, uptimeTil: Double, vaegMs: Double) -> String { - "{\"boot\":\(boot),\"uptimeUntil\":\(uptimeTil),\"until\":\(Int(vaegMs))}\n" +func spaerringJSON(boot: String, uptimeTil: Double, vaegMs: Double) -> String { + "{\"boot\":\"\(renTekst(boot))\",\"uptimeUntil\":\(uptimeTil),\"until\":\(Int(vaegMs))}\n" } -/// Spaerringen i SPAERRING_FIL -> sekunder tilbage, eller nil. R2 (Astra P1, Opus): samme opstart -> den monotone frist, -/// hoejst STAAENDE_PAUSE (falder LUKKET); en anden opstart -> ingen spaerring (en genstart af Mac'en afslutter alle laan); -/// en fil der ikke kan laeses -> hele pausen (falder lukket). -func spaerringTilbage(filTekst: String?, boot: Int, oppetid: Double) -> Double? { +/// Laes SPAERRING_FIL: (nil, false) = ingen fil; (nil, true) = filen findes, men kunne ikke laeses som tekst. +func laesSpaerringsfil(_ sti: String) -> (tekst: String?, fejl: Bool) { + guard FileManager.default.fileExists(atPath: sti) else { return (nil, false) } + guard let d = FileManager.default.contents(atPath: sti), let t = String(data: d, encoding: .utf8) else { return (nil, true) } + return (t, false) +} + +/// Spaerringen i SPAERRING_FIL -> sekunder tilbage, eller nil. R2/R3 (Astra P1, Opus): FALDER LUKKET - en fil der findes men +/// ikke kan laeses, ikke er gyldig, eller en opstart der ikke kan laeses, giver hele pausen. Kun en sikkert ANDEN opstart +/// (en genstart af Mac'en afslutter alle laan) eller en udloebet frist giver ingen spaerring. Hoejst STAAENDE_PAUSE. +func spaerringTilbage(filTekst: String?, laesefejl: Bool, boot: String?, oppetid: Double) -> Double? { + if laesefejl { return STAAENDE_PAUSE } guard let t = filTekst else { return nil } guard let d = t.data(using: .utf8), let o = try? JSONSerialization.jsonObject(with: d) as? [String: Any], - let b = (o["boot"] as? Int) ?? (o["boot"] as? Double).map({ Int($0) }), + let b = o["boot"] as? String, !b.isEmpty, let til = (o["uptimeUntil"] as? Double) ?? (o["uptimeUntil"] as? Int).map(Double.init) else { return STAAENDE_PAUSE } - guard b == boot, boot != 0 else { return nil } + guard let nu = boot else { return STAAENDE_PAUSE } + guard b == nu else { return nil } let rest = til - oppetid guard rest > 0 else { return nil } return min(rest, STAAENDE_PAUSE) diff --git a/helper/Sources/cmcp-status/main.swift b/helper/Sources/cmcp-status/main.swift index 49694dc2..3f5b1157 100644 --- a/helper/Sources/cmcp-status/main.swift +++ b/helper/Sources/cmcp-status/main.swift @@ -178,6 +178,20 @@ final class Anmodning { } // R53 (Opus): et fd der allerede er lukket, kan vaere genbrugt af en anden forbindelse - roer det ikke. func afslutLaan() { guard !lukket else { return }; shutdown(fd, SHUT_RDWR) } + /// R3 (Astra): HVORFOR laanet slutter («taken-back», «stopped-all», «expired»), skrevet foer forbindelsen lukkes - + /// saa serveren ikke skal gaette paa det ud fra tiden. + func afslutLaan(grund: String) { + guard !lukket else { return } + let linje = "{\"nonce\":\"\(s.nonce)\",\"ended\":\"\(grund)\"}\n" + linje.withCString { p in _ = write(fd, p, strlen(p)) } + afslutLaan() + } + /// R3 (Astra): et laan uden spoergsmaal, der maa vente, siger det - saa serveren ved, at INGEN blev spurgt. + func meldKoe() { + guard !besvaret, !lukket else { return } + let linje = "{\"nonce\":\"\(s.nonce)\",\"queued\":true}\n" + linje.withCString { p in _ = write(fd, p, strlen(p)) } + } } /// Hoejst ét laan ad gangen: skaermen er én. @@ -585,11 +599,12 @@ if CommandLine.arguments.contains("--dump-question") { // {"simulateLoanEndedSecondsAgo": N}: det forrige laan sluttede for N sekunder siden. Og spaerringen i // SPAERRING_FIL i tilstandsmappen laeses som ved ikonets start (R1: den overlever en genstart). let nu = oppetid() - var spaerret: Double? = spaerringTilbage(filTekst: try? String(contentsOfFile: (stateDir as NSString).appendingPathComponent(SPAERRING_FIL), encoding: .utf8), - boot: bootTid(), oppetid: nu).map { nu + $0 } + let fil = laesSpaerringsfil((stateDir as NSString).appendingPathComponent(SPAERRING_FIL)) + var spaerret: Double? = spaerringTilbage(filTekst: fil.tekst, laesefejl: fil.fejl, boot: bootSession(), oppetid: nu).map { nu + $0 } // R2: uret og opstarten, saa proeven kan skrive en gyldig fil - og en rundtur skriver -> laeser. - ud["clock"] = ["boot": bootTid(), "uptime": nu] - ud["blockFileRoundTrip"] = spaerringTilbage(filTekst: spaerringJSON(boot: bootTid(), uptimeTil: nu + 60, vaegMs: 0), boot: bootTid(), oppetid: nu) ?? -1 + ud["clock"] = ["boot": bootSession() ?? "", "uptime": nu] + ud["blockFileRoundTrip"] = spaerringTilbage(filTekst: spaerringJSON(boot: bootSession() ?? "", uptimeTil: nu + 60, vaegMs: 0), laesefejl: false, + boot: bootSession(), oppetid: nu) ?? -1 var ledig: Double? = nil if let raw = try? JSONSerialization.jsonObject(with: raa) as? [String: Any] { if let siden = (raw["simulateTakenBackSecondsAgo"] as? Double) ?? (raw["simulateTakenBackSecondsAgo"] as? Int).map(Double.init) { @@ -1073,7 +1088,7 @@ final class Ikon: NSObject, NSMenuDelegate, UNUserNotificationCenterDelegate { aktivtLaan = a; laanTil = til laanOpdateret() // S2b-2: Esc bliver stoptast, saa laenge laanet varer DispatchQueue.main.asyncAfter(deadline: .now() + Double(minutter) * 60) { - if aktivtLaan === a { a.afslutLaan() } + if aktivtLaan === a { a.afslutLaan(grund: "expired") } } case .svar(let v): a.svar(ok: v) @@ -1098,14 +1113,14 @@ final class Ikon: NSObject, NSMenuDelegate, UNUserNotificationCenterDelegate { let post = "{\"ts\":\(Int(Date().timeIntervalSince1970 * 1000)),\"source\":\"\(kilde)\"}\n" // R45 (Opus G): en fejlet skrivning maa ikke vaere tavs - lyd + note; laanet gives tilbage uanset. do { try post.write(toFile: sti, atomically: true, encoding: .utf8) } catch { NSSound.beep(); noterKilde("stop-all-write-failed") } - aktivtLaan?.afslutLaan() + aktivtLaan?.afslutLaan(grund: "stopped-all") tik() } /// Menuens og boksens stopknap: samme vej, hvert sit kildemaerke (R22). func tagTilbageNu(kilde: String) { noterKilde(kilde) - aktivtLaan?.afslutLaan() + aktivtLaan?.afslutLaan(grund: "taken-back") spaerStaaende() // 2/11: foer tik() - og foer lukningens oprydning, som koerer bagefter (DispatchQueue.main.async) tik() } @@ -1116,7 +1131,7 @@ final class Ikon: NSObject, NSMenuDelegate, UNUserNotificationCenterDelegate { staaendeSpaerretTil = oppetid() + STAAENDE_PAUSE // R1/R2 (Astra P1): gemt med opstartens id og den monotone frist, saa et ikon der genstarter inden for pausen, ogsaa // holder den. Fejler skrivningen, holder spaerringen stadig i denne proces - og det noteres. - let post = spaerringJSON(boot: bootTid(), uptimeTil: staaendeSpaerretTil ?? 0, vaegMs: Date().timeIntervalSince1970 * 1000 + STAAENDE_PAUSE * 1000) + let post = spaerringJSON(boot: bootSession() ?? "", uptimeTil: staaendeSpaerretTil ?? 0, vaegMs: Date().timeIntervalSince1970 * 1000 + STAAENDE_PAUSE * 1000) do { try post.write(toFile: (stateDir as NSString).appendingPathComponent(SPAERRING_FIL), atomically: true, encoding: .utf8) } catch { noterKilde("standing-block-write-failed") } } @@ -1142,7 +1157,7 @@ final class Ikon: NSObject, NSMenuDelegate, UNUserNotificationCenterDelegate { aktivtLaan = a; laanTil = til laanOpdateret() // S2b-2: Esc bliver stoptast, saa laenge laanet varer DispatchQueue.main.asyncAfter(deadline: .now() + Double(minutter) * 60) { - if aktivtLaan === a { a.afslutLaan() } + if aktivtLaan === a { a.afslutLaan(grund: "expired") } } } @@ -1209,7 +1224,7 @@ final class Ikon: NSObject, NSMenuDelegate, UNUserNotificationCenterDelegate { func vis(_ a: Anmodning) { // 2/11: et laan uden spoergsmaal er ikke et spoergsmaal - ingen lyd, intet banner. Gives straks, eller venter i koeen. - if a.s.kind == "screen" && a.s.ask == false { givStaaendeLaan(); tik(); return } + if a.s.kind == "screen" && a.s.ask == false { givStaaendeLaan(); if !a.besvaret { a.meldKoe() }; tik(); return } tik() if lydHukommelse.skalLyde(nonce: a.s.nonce, lukket: a.lukket, besvaret: a.besvaret, til: lydSlaaetTil()) { NSSound(named: "Glass")?.play() @@ -1296,8 +1311,8 @@ genveje.vedStop = { ikon.stopAlleNu(kilde: "stop-all-hotkey") } genveje.vedEsc = { ikon.stopAlleNu(kilde: "stop-all-esc-loan") } nyAnmodning = { a in ikon.vis(a) } // R1 (Astra P1): en spaerring fra et tidligere ikon (genstartet inden for pausen) gaelder stadig. -if let rest = spaerringTilbage(filTekst: try? String(contentsOfFile: (stateDir as NSString).appendingPathComponent(SPAERRING_FIL), encoding: .utf8), - boot: bootTid(), oppetid: oppetid()) { +let startFil = laesSpaerringsfil((stateDir as NSString).appendingPathComponent(SPAERRING_FIL)) +if let rest = spaerringTilbage(filTekst: startFil.tekst, laesefejl: startFil.fejl, boot: bootSession(), oppetid: oppetid()) { staaendeSpaerretTil = oppetid() + rest } // R2 (Astra): et ikon der lige er startet (maaske fordi det forrige doede midt i et laan), giver intet laan uden spoergsmaal diff --git a/mcp-server/godkend.js b/mcp-server/godkend.js index f5815e12..9514cfc6 100644 --- a/mcp-server/godkend.js +++ b/mcp-server/godkend.js @@ -190,6 +190,9 @@ export async function laanSkaermen({ session, client, text, minutter, spoerg = t const nonce = randomBytes(16).toString('hex'); const frist = Date.now() + timeoutSec * 1000; let buf = '', svaret = false, lukket = false; + // R3 (Astra): «queued» = ikonet har sagt, at laanet uden spoergsmaal venter (INGEN blev spurgt). «ended» = hvorfor + // laanet sluttede (taken-back / stopped-all / expired), skrevet af ikonet foer det lukker. Et aeldre ikon sender ingen. + let koeBekraeftet = false, slutGrund = null; let glemLaanAfbrydelse = () => {}; // R42: erklaeret FOER afgoer - et afbrudt signal kalder straks tilbage // Maalingen (punkt P) skal staa paa loglinjen, saa svaret venter paa den - hoejst // 1,5 s. Ved et ja maales ingen ny idle (et menneske svarede netop); kun maalingen @@ -199,8 +202,11 @@ export async function laanSkaermen({ session, client, text, minutter, spoerg = t afslutMaaling(v.ok === true).then((x) => { senesteMaaling = x; }, () => {}).finally(() => resolve(v)); }; const sock = createConnection(IKON_SOCKET); + // R3 (Astra P2): kun naar ikonet SELV sagde «queued», ved vi at ingen blev spurgt. Ellers kan et aeldre ikon have vist + // et spoergsmaal, ingen svarede paa - det er ukendt (spurgt: null), og svaret er det almindelige «spoerg ikke igen». const ur = setTimeout(() => { afgoer(spoerg ? { ok: false, grund: 'nobody answered in the menu bar in time' } - : { ok: false, koe: true, spurgt: false, grund: `the screen was not free when the wait of ${Math.round(timeoutSec)} s ran out (another agent had it, or the person took it back less than two minutes ago)` }); sock.destroy(); }, timeoutSec * 1000); + : koeBekraeftet ? { ok: false, koe: true, spurgt: false, grund: `the screen was not free when the wait of ${Math.round(timeoutSec)} s ran out (another agent had it, or the person took it back less than two minutes ago)` } + : { ok: false, spurgt: null, grund: 'nobody answered in the menu bar in time (the menu bar icon did not say whether it asked the person)' }); sock.destroy(); }, timeoutSec * 1000); // R42: afbrydes kaldet foer svaret, traekkes spoergsmaalet tilbage, og et senere ja kan ikke give laanet. glemLaanAfbrydelse = vedAfbrydelse(() => { if (!svaret) { afgoer({ ok: false, afbrudt: true, grund: afbrudtGrund('the question was withdrawn') }); sock.destroy(); } }); sock.on('connect', () => { @@ -217,34 +223,45 @@ export async function laanSkaermen({ session, client, text, minutter, spoerg = t }) + '\n'); }); sock.on('data', (d) => { - if (svaret) return; buf += d; - const i = buf.indexOf('\n'); if (i < 0) return; - let m = null; try { m = JSON.parse(buf.slice(0, i)); } catch {} - if (!m || m.nonce !== nonce) { afgoer({ ok: false, grund: 'the answer did not match the question' }); return sock.destroy(); } - if (Date.now() > frist) { afgoer({ ok: false, grund: 'the answer came after the question had expired' }); return sock.destroy(); } - if (m.ok === true && m.verified === 'owner') { - const vores = Date.now() + minutter * 60_000; - const til = Math.min(vores, Number(m.until) > 0 ? Number(m.until) : vores); - return afgoer({ ok: true, til, afslut: () => sock.destroy(), grund: 'the person gave this agent the screen and confirmed it was them', spurgt: true }); + let i; + while ((i = buf.indexOf('\n')) >= 0) { + const linje = buf.slice(0, i); buf = buf.slice(i + 1); + let m = null; try { m = JSON.parse(linje); } catch {} + if (svaret) { + // R3: efter ja'et kan ikonet sige, HVORFOR laanet slutter - foer det lukker forbindelsen. + if (m && m.nonce === nonce && typeof m.ended === 'string') slutGrund = m.ended; + continue; + } + // R3: et laan uden spoergsmaal, der venter i ikonets koe - ikke et svar; der ventes videre. + if (!spoerg && m && m.nonce === nonce && m.queued === true && m.ok === undefined) { koeBekraeftet = true; continue; } + if (!m || m.nonce !== nonce) { afgoer({ ok: false, grund: 'the answer did not match the question' }); return sock.destroy(); } + if (Date.now() > frist) { afgoer({ ok: false, grund: 'the answer came after the question had expired' }); return sock.destroy(); } + if (m.ok === true && m.verified === 'owner') { + const vores = Date.now() + minutter * 60_000; + const til = Math.min(vores, Number(m.until) > 0 ? Number(m.until) : vores); + afgoer({ ok: true, til, afslut: () => sock.destroy(), grund: 'the person gave this agent the screen and confirmed it was them', spurgt: true }); + continue; + } + // 2/11: «standing» = ikonet gav laanet uden et spoergsmaal. Godtages KUN naar denne server selv bad om det + // (CMCP_SCREEN_ASK=0) - ellers er det et svar paa noget ingen har slaaet til, og det er et nej. + if (m.ok === true && m.verified === 'standing' && !spoerg) { + const vores = Date.now() + minutter * 60_000; + const til = Math.min(vores, Number(m.until) > 0 ? Number(m.until) : vores); + afgoer({ ok: true, til, afslut: () => sock.destroy(), grund: 'the person has set this Mac to lend the screen without asking (CMCP_SCREEN_ASK=0)', spurgt: false }); + continue; + } + if (m.verified === 'optaget') { afgoer({ ok: false, grund: 'another agent has the screen right now' }); return sock.destroy(); } + if (m.ok === false) pauseTil = Date.now() + PAUSE_MS; + // R1 (Astra P2): loggens «asked» foelger hvad der faktisk skete - et nej i boksen er et spoergsmaal. + afgoer({ ok: false, spurgt: m.ok === false ? true : undefined, grund: m.ok === false ? 'the person said no in the menu bar' : 'the answer was not confirmed by the person (Touch ID or password)' }); + return sock.destroy(); } - // 2/11: «standing» = ikonet gav laanet uden et spoergsmaal. Godtages KUN naar denne server selv bad om det - // (CMCP_SCREEN_ASK=0) - ellers er det et svar paa noget ingen har slaaet til, og det er et nej. - if (m.ok === true && m.verified === 'standing' && !spoerg) { - const vores = Date.now() + minutter * 60_000; - const til = Math.min(vores, Number(m.until) > 0 ? Number(m.until) : vores); - return afgoer({ ok: true, til, afslut: () => sock.destroy(), grund: 'the person has set this Mac to lend the screen without asking (CMCP_SCREEN_ASK=0)', spurgt: false }); - } - if (m.verified === 'optaget') { afgoer({ ok: false, grund: 'another agent has the screen right now' }); return sock.destroy(); } - if (m.ok === false) pauseTil = Date.now() + PAUSE_MS; - // R1 (Astra P2): loggens «asked» foelger hvad der faktisk skete - et nej i boksen er et spoergsmaal. - afgoer({ ok: false, spurgt: m.ok === false ? true : undefined, grund: m.ok === false ? 'the person said no in the menu bar' : 'the answer was not confirmed by the person (Touch ID or password)' }); - sock.destroy(); }); const luk = () => { if (lukket) return; lukket = true; if (!svaret) return afgoer({ ok: false, grund: 'the menu bar icon closed without an answer' }); - slut?.(); + slut?.(slutGrund); }; sock.on('close', luk); sock.on('error', luk); diff --git a/mcp-server/helper.js b/mcp-server/helper.js index d4b9b456..fbcfa347 100644 --- a/mcp-server/helper.js +++ b/mcp-server/helper.js @@ -1,4 +1,4 @@ -import { execFile } from 'child_process'; +import { execFile, execFileSync } from 'child_process'; import { existsSync } from 'fs'; import { dirname, join } from 'path'; import { fileURLToPath } from 'url'; @@ -107,6 +107,27 @@ function draebBlidt(child) { ur.unref?.(); } +/// R3 (Astra P1): til en server der skal LUKKE. Stop alt der skriver - og VENT paa det: SIGTERM (paste: SIGUSR1), saa +/// SIGKILL efter `maksMs`, og et traek der maatte draebes, slippes af en ny hjaelper (synkront, hoejst 5 s). En exit-handler +/// kan ikke vente, og timerne i draebBlidt naar aldrig at koere, naar processen gaar - derfor denne vej ved et lukkesignal. +export async function stopOgVent(maksMs = 2000) { + const boern = [...levende.entries()].filter(([, argv]) => !(OPSLAG.has(argv[0]) || argv.includes('--dry'))); + for (const [child, argv] of boern) { child.afbrudtAfLaan = true; try { child.kill(argv[0] === 'paste' ? 'SIGUSR1' : 'SIGTERM'); } catch { /* vaek */ } } + const doed = (c) => c.exitCode !== null || c.signalCode !== null; + const slut = Date.now() + maksMs; + while (Date.now() < slut && boern.some(([c]) => !doed(c))) await new Promise(r => setTimeout(r, 50)); + for (const [child, argv] of boern) { + if (doed(child)) continue; + try { child.kill('SIGKILL'); } catch { continue; } + if (argv[0] === 'drag') { + const fra = (n) => { const i = argv.indexOf(n); return i >= 0 ? String(argv[i + 1]) : null; }; + const start = fra('--from-x') && fra('--from-y') ? ['--from-x', fra('--from-x'), '--from-y', fra('--from-y')] : []; + try { execFileSync(helperPath(), ['release-mouse', ...start], { timeout: 5000, stdio: 'ignore' }); } catch { /* ingen hjaelper */ } + } + } + return boern.length; +} + export function callHelper(args, { timeout = 30000, stdin = null } = {}) { return new Promise((resolve, reject) => { const bin = helperPath(); diff --git a/mcp-server/index.js b/mcp-server/index.js index eb7ef860..8bac15d1 100644 --- a/mcp-server/index.js +++ b/mcp-server/index.js @@ -26,7 +26,7 @@ import { TOOLS, TOOL_BY_NAME, describe } from './tools.js'; import { spoergOmGoerSelv, laanSkaermen, tagMaaling, iHandling, handlingVenterStadig, kaldAfbrudt, restMs, stopAlleKald, kaldStoppet, afbrudtGrund } from './godkend.js'; import { BESKED_APPS, beskedSlags, WEBMAIL, WEBCHAT, SENDE_ORD, tastSender, saetLaan, laanAktivt, laanTilTid, baggrundLaast, laanOejeblik } from './policy.js'; import { TIER, ALWAYS_ASK_APPS, SPOERG_PR_SESSION, decide, currentMode, askHumanToDo, askTimeout, skaermVentetid, skaermUdenSpoergsmaal, menuSerFarlig, tastSerFarlig, baggrund, TAGER_SKAERMEN, KAN_STILLES, MANGLER_FOR_STILLE, kaldErStille, tagerSkaermen, resetSession, glemSessionsProgrammer, isSessionGranted, sessionsProgrammer } from './policy.js'; -import { callHelper, HelperError, helperPath, frontmostBundleId, resolveBundleId, resolveApp, resolveAppStrict, afbrydSkaermKald } from './helper.js'; +import { callHelper, HelperError, helperPath, frontmostBundleId, resolveBundleId, resolveApp, resolveAppStrict, afbrydSkaermKald, stopOgVent } from './helper.js'; import { record, scrubArgs, kendNoegler, fingerprint, AUDIT_PATH, noterVentende, ventende, KOE_PATH, kaedenHolder, SESSION, loggenKanSkrives, iKald } from './audit.js'; import { medProgramLaas } from './programlaas.js'; import { taelOgTael } from './sloejfe.js'; @@ -405,7 +405,8 @@ let tagetTilbageVed = 0; const TILBAGE_PAUSE_MS = 120_000; const TILBAGE_STOP = 'Stop, and tell them in the chat what you were doing - do not request the screen again by yourself.'; // Kun uden spoergsmaal: med spoergsmaalet afgoer mennesket hvert laan selv, og intet aendres dér. -const nyligtTagetTilbage = () => skaermUdenSpoergsmaal() && tagetTilbageVed > 0 && Date.now() - tagetTilbageVed < TILBAGE_PAUSE_MS; +// R3 (Astra): maalt paa et monotont ur - et vaegur der springer, forlaenger eller forkorter ikke pausen. +const nyligtTagetTilbage = () => skaermUdenSpoergsmaal() && tagetTilbageVed > 0 && performance.now() - tagetTilbageVed < TILBAGE_PAUSE_MS; const POSTER_INPUT = new Set(['computer_click', 'computer_move', 'computer_drag', 'computer_scroll', 'computer_type', 'computer_key', 'computer_paste', 'computer_space']); // agenten gav selv skaermen tilbage (en loglinje, ikke to) // hvert laan sit nummer: et gammelt laans slut roerer ikke et nyt let sidsteEgenHandling = 0; const klientNavn = () => server.getClientVersion?.()?.name || process.env.CMCP_CLIENT || null; @@ -476,15 +477,17 @@ async function skaermLaan(args) { } const spoerg = !skaermUdenSpoergsmaal() || tagetTilbageVed > 0; const svar = await laanSkaermen({ session: SESSION, client: klientNavn(), text: laanTekst, minutter: min, spoerg }, - skaermVentetid(), async () => { + skaermVentetid(), async (slutGrund) => { // Forbindelsen er lukket: tiden gik, mennesket tog skaermen, ikonet doede, // eller agenten gav den tilbage. Kun DETTE laans slut taeller. if (nr === null) { lukketFoerStart = true; return; } if (nr !== laanNr) return; - // R2: sluttede laanet foer tid, og ikke fordi agenten gav det tilbage, tog mennesket det (eller ikonet lukkede). + // R3 (Astra): ikonet siger HVORFOR (taken-back / stopped-all / expired). Kun uden grund (et aeldre ikon, eller et + // ikon der doede) gaettes der: sluttede laanet foer tid, og ikke fordi agenten gav det tilbage = taget tilbage. const plan = laanTilTid(); - const tagetTilbage = !laanAfgivet && plan > 0 && Date.now() < plan - 1500; - if (tagetTilbage) tagetTilbageVed = Date.now(); + const tagetTilbage = !laanAfgivet && (slutGrund ? (slutGrund === 'taken-back' || slutGrund === 'stopped-all') + : (plan > 0 && Date.now() < plan - 1500)); + if (tagetTilbage) tagetTilbageVed = performance.now(); saetLaan(0); laanHaandtag = null; // ⛔ Runde 1 (Astra 4): et traek eller en skrivning der er i gang, stoppes. const stoppet = afbrydSkaermKald(); @@ -501,7 +504,8 @@ async function skaermLaan(args) { return errorResult('Cancelled: the client cancelled this call, so the screen was handed straight back.'); } // R1 (Astra P2): et aeldre ikon spoerger stadig og svarer «owner» - saa blev mennesket spurgt, uanset kontakten. - log(svar.ok ? 'allowed' : 'denied', svar.grund, svar.spurgt ?? spoerg); + // R3: null = ukendt (et aeldre ikon kan have spurgt) - IKKE det samme som «ikke oplyst» (undefined -> kontakten). + log(svar.ok ? 'allowed' : 'denied', svar.grund, svar.spurgt !== undefined ? svar.spurgt : spoerg); // R45 (Opus F): et stop under ventetiden er ikke et nej - «use the quiet tools» ville bede agenten fortsaette. if (!svar.ok && kaldStoppet()) return errorResult(`Stopped: ${svar.grund}. Ask them in the chat what they want before you continue.`); if (!svar.ok) { @@ -513,6 +517,8 @@ async function skaermLaan(args) { // Runde 2 (Astra F5): kan laanet ikke skrives i loggen efter ja'et, gives det ikke. if (!loggenKanSkrives()) { svar.afslut?.(); return errorResult(`Refused: the audit log at ${AUDIT_PATH} cannot be written, and the screen is not lent without a record.`); } nr = ++laanNr; laanAfgivet = false; + // R3 (Astra): mennesket bekraeftede selv dette laan (Touch ID) efter et «tag tilbage» - saa gaelder stoppet ikke laengere. + if (svar.spurgt === true) tagetTilbageVed = 0; saetLaan(svar.til); laanHaandtag = svar.afslut; record({ tool: 'computer_request_screen', outcome: 'lent', until: new Date(svar.til).toISOString() }); // Vores eget ur ogsaa: udloeber laanet, lukkes forbindelsen, og listen meldes. @@ -2289,7 +2295,8 @@ async function haandterKald(request) { target: targetBundleId, decision: stopVenter ? 'waiting' : 'denied', asked: verdict.asked, ...(verdict.asker === 'menubar' ? { asker: 'menubar' } : {}), reason: stopgrund }); if (kaldStoppet()) return errorResult(`Stopped: ${stopgrund}. Ask them in the chat before you continue.`); - if (stopTilbage) return errorResult(`Refused: ${stopgrund}. Nothing was done. ${TILBAGE_STOP}`); + // R3 (Astra): har mennesket taget skaermen fra agenten, er svaret et stop - uanset hvilken kontrol der afviste foerst. + if (stopTilbage || nyligtTagetTilbage()) return errorResult(`Refused: ${stopTilbage ? stopgrund : 'the person took the screen back from this agent, so it was not done'}. Nothing was done. ${TILBAGE_STOP}`); return errorResult(`${stopVenter ? 'Waiting' : 'Refused'}: ${stopgrund}. Nothing was done. Call it again.`); } if (!laast.ok) { @@ -2414,6 +2421,12 @@ function liveTekst(navn, a) { const transport = new StdioServerTransport(); await server.connect(transport); statusStart({ session: SESSION, client: process.env.CMCP_CLIENT, version: PKG.version }); +// ⛔ R3 (Astra P1): et lukkesignal stopper serverens skrivende hjaelpere og VENTER paa dem (SIGKILL efter 2 s, noedslip af et +// traek), foer serveren gaar. Erstatter baade linjen tidligere i filen og status.js' egen exit(0) (registreret i statusStart) - +// status.js rydder stadig sin fil i sin 'exit'-lytter. Samme vej, naar klienten er vaek (startVagt). +let lukker = false; +const lukPaent = () => { if (lukker) return; lukker = true; stopOgVent(2000).catch(() => {}).finally(() => process.exit(0)); }; +for (const sig of ['SIGTERM', 'SIGINT', 'SIGHUP']) { process.removeAllListeners(sig); process.on(sig, lukPaent); } // Doer chatten, doer serveren med. Stdin lukker normalt foerst - men en klient // der bliver draebt, lukker ingenting, og serveren staar tilbage med // tilgaengeligheds-rettigheder og taeller med i «hvor mange agenter koerer». diff --git a/mcp-server/vagt.js b/mcp-server/vagt.js index 07187418..b837fd08 100644 --- a/mcp-server/vagt.js +++ b/mcp-server/vagt.js @@ -61,7 +61,9 @@ export function startVagt({ if (!start || start <= 1) return () => {}; const luk = nuLuk || (() => { process.stderr.write('[computer-mcp] the client that started this server is gone; shutting down\n'); - process.exit(0); + // R3 (Astra): har serveren sin paene nedlukning (SIGTERM-lytteren stopper og VENTER paa hjaelperne), gaa den vej. + if (process.listenerCount('SIGTERM') > 0) process.emit('SIGTERM', 'SIGTERM'); + else process.exit(0); }); const t = setInterval(() => { if (erForaeldreloes(start, nuPpid, kill)) luk(); }, intervalMs); t.unref?.(); diff --git a/test/falsk-hjaelper.mjs b/test/falsk-hjaelper.mjs index 0a872fc6..e338885d 100644 --- a/test/falsk-hjaelper.mjs +++ b/test/falsk-hjaelper.mjs @@ -92,6 +92,8 @@ try { writeSync(1, JSON.stringify({ ok: false, code: 'screen-taken-back', error: 'stopped before pasting: the screen loan ended' }) + '\\n'); process.exit(1); }); + // R3: «_ignorerTerm» - som den rigtige hjaelper, der blokerer SIGTERM midt i et trin (B19). Kun SIGKILL stopper den. + if (SVAR[noegle]._ignorerTerm) process.on('SIGTERM', () => {}); await new Promise(r => setTimeout(r, SVAR[noegle]._vent)); } // «_raekke» (R29, Astra): et svar pr. kald i raekkefoelge (det sidste gentages) - saa en diff --git a/test/ikon-boks.mjs b/test/ikon-boks.mjs index c19f3a4e..5153aed4 100644 --- a/test/ikon-boks.mjs +++ b/test/ikon-boks.mjs @@ -269,8 +269,15 @@ const tikKrop = krop('func tik() {'); // R2 (Opus M1/M2 overlevede): KALDESTEDET bruger spaerringen og pausen, og skriveren gemmer den rigtige frist. check('5z givStaaendeLaan bruger spaerringen OG overdragelsespausen (ikke nil)', /spaerretTil: staaendeSpaerretTil, ledigFra: laanLedigFra, nu: nu\)/.test(giv), giv.slice(0, 200)); check('5z spaerStaaende gemmer den monotone frist, den lige har sat (ikke en udloebet)', - kald(spaer, 'staaendeSpaerretTil = oppetid() + STAAENDE_PAUSE') >= 0 && /spaerringJSON\(boot: bootTid\(\), uptimeTil: staaendeSpaerretTil \?\? 0,/.test(spaer), spaer.slice(0, 200)); + kald(spaer, 'staaendeSpaerretTil = oppetid() + STAAENDE_PAUSE') >= 0 && /spaerringJSON\(boot: bootSession\(\) \?\? "", uptimeTil: staaendeSpaerretTil \?\? 0,/.test(spaer), spaer.slice(0, 200)); check('5z et nystartet ikon giver tidligst et laan uden spoergsmaal efter OVERDRAG_PAUSE', /\nlaanLedigFra = oppetid\(\) \+ OVERDRAG_PAUSE/.test(m)); + // R3 (Astra): ikonet SIGER hvorfor laanet slutter, og at et laan uden spoergsmaal venter. + check('5z tag-tilbage, stop-alle og udloeb sender hver sin grund foer lukningen', + /aktivtLaan\?\.afslutLaan\(grund: "taken-back"\)/.test(tilbage) && /aktivtLaan\?\.afslutLaan\(grund: "stopped-all"\)/.test(stopA) + && (m.match(/if aktivtLaan === a \{ a\.afslutLaan\(grund: "expired"\) \}/g) || []).length === 2 + && /func afslutLaan\(grund: String\) \{[\s\S]{0,200}\\"ended\\":[\s\S]{0,120}afslutLaan\(\)\n\s+\}/.test(m)); + check('5z et laan uden spoergsmaal, der maa vente, melder «queued»', + /if a\.s\.kind == "screen" && a\.s\.ask == false \{ givStaaendeLaan\(\); if !a\.besvaret \{ a\.meldKoe\(\) \}/.test(m) && /func meldKoe\(\) \{[\s\S]{0,200}\\"queued\\":true/.test(m)); check('5z et laan der slutter, giver tidligst det naeste efter OVERDRAG_PAUSE', /if aktivtLaan === a \{ laanLedigFra = oppetid\(\) \+ OVERDRAG_PAUSE; aktivtLaan = nil/.test(m)); } check('5r synligheden (R24, adfaerd): et laan holder boksen fremme uanset alt; ellers kun naar nogen arbejder, der er sessioner, og boksen ikke er slaaet fra', @@ -304,7 +311,7 @@ check('5n laanet holder boksen fremme - ogsaa stille og ogsaa naar boksen er sla check('5o boksens stopknap er menuens: samme tagTilbageNu, eget kildemaerke, intet Touch ID', /case \.tagTilbage: tagTilbageNu\(kilde: "take-back-box"\)/.test(knapKrop) && /@objc func tagTilbage\(\) \{ tagTilbageNu\(kilde: "take-back"\) \}/.test(m) - && /func tagTilbageNu\(kilde: String\) \{\n\s+noterKilde\(kilde\)\n\s+aktivtLaan\?\.afslutLaan\(\)/.test(m)); + && /func tagTilbageNu\(kilde: String\) \{\n\s+noterKilde\(kilde\)\n\s+aktivtLaan\?\.afslutLaan\(grund: "taken-back"\)/.test(m)); check('5p stopknappen slaas aldrig fra - hverken af pausen eller af Touch ID-arket', /b\.isEnabled = aktiv \|\| b\.title == TAG_TILBAGE/.test(m)); // 8 · agentens egne tekster peger paa boksen (R22: 0 af 2 svar i menulinjen 9/10, 2 af 2 i boksen) const vaerktoejer = readFileSync(join(ROOT, 'mcp-server', 'tools.js'), 'utf8'); diff --git a/test/ikon-menu.mjs b/test/ikon-menu.mjs index da2ca3d9..5673e93d 100644 --- a/test/ikon-menu.mjs +++ b/test/ikon-menu.mjs @@ -7,7 +7,7 @@ // tekst som JSON UDEN at vise noget. Ikonet startes aldrig her. import './ryd-op.mjs'; import { execFileSync } from 'node:child_process'; -import { existsSync, statSync, mkdtempSync, writeFileSync, unlinkSync } from 'node:fs'; +import { existsSync, statSync, mkdtempSync, writeFileSync, unlinkSync, chmodSync } from 'node:fs'; import { tmpdir } from 'node:os'; import { join, dirname } from 'node:path'; import { fileURLToPath } from 'node:url'; @@ -95,7 +95,7 @@ check('3g ...for 7 s siden: venter stadig (pausen er 8 s: 2 s stop + 5 s noedsli check('3g ...for 9 s siden: gives', vis({ ...lan, ask: false, simulateLoanEndedSecondsAgo: 9 }).lendsWithoutAsking === true); // R2 (Astra P1): filen baerer opstartens id + en MONOTON frist; skriver -> laeser er samme format (rundtur). const ur = vis({ ...lan, ask: false }).clock || {}; -check('3g instrument: ikonet oplyser opstart og oppetid', ur.boot > 0 && ur.uptime > 0, JSON.stringify(ur)); +check('3g instrument: ikonet oplyser opstart (kern.bootsessionuuid) og oppetid', typeof ur.boot === 'string' && ur.boot.length > 10 && ur.uptime > 0, JSON.stringify(ur)); check('3g rundtur: skriverens linje laeses tilbage som ca. 60 s', Math.abs(vis(lan).blockFileRoundTrip - 60) < 2, String(vis(lan).blockFileRoundTrip)); const SPF = join(STATE, 'skaerm-spaerret.json'); const skriv = (o) => writeFileSync(SPF, typeof o === 'string' ? o : JSON.stringify(o)); @@ -104,13 +104,19 @@ let c = nuUr(); skriv({ boot: c.boot, uptimeUntil: c.uptime + 60 }); check('3g spaerringen fra et tidligere ikon (60 s tilbage, samme opstart) gaelder efter genstart', vis({ ...lan, ask: false }).lendsWithoutAsking === false); c = nuUr(); skriv({ boot: c.boot, uptimeUntil: c.uptime - 1 }); check('3g ...udloebet (samme opstart): gives', vis({ ...lan, ask: false }).lendsWithoutAsking === true); -c = nuUr(); skriv({ boot: c.boot - 1000, uptimeUntil: c.uptime + 60 }); +c = nuUr(); skriv({ boot: 'en-anden-opstart', uptimeUntil: c.uptime + 60 }); check('3g ...fra en ANDEN opstart af Mac\'en: ingen spaerring', vis({ ...lan, ask: false }).lendsWithoutAsking === true); c = nuUr(); skriv({ boot: c.boot, uptimeUntil: c.uptime + 10 * 86_400 }); const v10 = vis({ ...lan, ask: false }); check('3g ...10 dage frem: spaerret, men hoejst pausen (falder lukket, ikke for evigt)', v10.lendsWithoutAsking === false && v10.standingBlockedSeconds <= 120, String(v10.standingBlockedSeconds)); skriv('ikke json'); -check('3g ...en ulaeselig fil: spaerret (falder lukket)', vis({ ...lan, ask: false }).lendsWithoutAsking === false); +check('3g ...en fil med ugyldigt indhold: spaerret (falder lukket)', vis({ ...lan, ask: false }).lendsWithoutAsking === false); +// R3 (Astra P1): en fil der FINDES men ikke kan laeses, er ikke bevis for en genstart af Mac'en - spaerret. +writeFileSync(SPF, Buffer.from([0xff, 0xfe, 0x00, 0xc3])); +check('3g ...en fil der ikke er tekst (ugyldig UTF-8): spaerret', vis({ ...lan, ask: false }).lendsWithoutAsking === false); +c = nuUr(); skriv({ boot: c.boot, uptimeUntil: c.uptime + 60 }); chmodSync(SPF, 0o000); +check('3g ...en fil der ikke kan laeses (ingen adgang): spaerret', vis({ ...lan, ask: false }).lendsWithoutAsking === false); +chmodSync(SPF, 0o600); unlinkSync(SPF); // 3h (panel R2, Opus 🔴): et laan uden spoergsmaal, der venter (spaerring, overdragelse, en anden agent), maa ikke vises som // «Allow (Touch ID)/Deny» - tavshed giver skaermen, saa kun Deny staar, i menuen og i boksen. diff --git a/test/skaerm-laan.mjs b/test/skaerm-laan.mjs index f8932f3e..c2548b78 100644 --- a/test/skaerm-laan.mjs +++ b/test/skaerm-laan.mjs @@ -28,6 +28,8 @@ const vent = ms => new Promise(r => setTimeout(r, ms)); function lavIkon(state) { const ikon = { svar: 'ja', laanMs: 60_000, spurgt: [], laan: null, lukketAfServer: 0, koe: [] }; + // R3: slut laanet som det rigtige ikon goer - grunden («taken-back», «stopped-all», «expired») foerst, saa lukning. + ikon.slut = (grund) => { try { ikon.laan.write(JSON.stringify({ nonce: ikon.laanNonce, ended: grund }) + '\n'); } catch {} setTimeout(() => ikon.laan.destroy(), 30); }; // Skaerm-koe (2/10): naar det aktive laan slutter, svares den AELDSTE ventende // skaerm-anmodning «ja» - ingen ny forespoergsel noedvendig (ikke en afvisning). // ⛔ MAALT: en lokal .destroy() udloeser «close» paa EGEN socket, ikke «end» @@ -48,6 +50,8 @@ function lavIkon(state) { const q = JSON.parse(buf.slice(0, i)); ikon.spurgt.push(q); svaret = true; if (ikon.svar === 'koe' && q.kind === 'screen') { if (ikon.laan) { + // R3: et laan uden spoergsmaal faar «queued» tilbage, som det rigtige ikon sender (meldKoe). + if (q.ask === false && !ikon.ingenKoeSvar) sock.write(JSON.stringify({ nonce: q.nonce, queued: true }) + '\n'); // Et andet laan har allerede skaermen: staar i koen, IKKE afvist - // serveren venter selv (skaermVentetid()), fake-ikonet svarer foerst // naar koen aabner (naesteIKoe). @@ -63,7 +67,7 @@ function lavIkon(state) { ikon.laan = sock; sock.on('end', () => { ikon.lukketAfServer++; }); } else if (ikon.svar === 'staaende') { // 2/11: mennesket har slaaet spoergsmaalet fra - ikonet giver straks sock.write(JSON.stringify({ nonce: q.nonce, ok: true, verified: 'standing', until: Date.now() + ikon.laanMs }) + '\n'); - ikon.laan = sock; sock.on('end', () => { ikon.lukketAfServer++; }); + ikon.laan = sock; ikon.laanNonce = q.nonce; sock.on('end', () => { ikon.lukketAfServer++; }); } else if (ikon.svar === 'ja') { sock.write(JSON.stringify({ nonce: q.nonce, ok: true, verified: 'owner', until: Date.now() + ikon.laanMs }) + '\n'); ikon.laan = sock; // forbindelsen holdes AABEN: den er laanet @@ -486,6 +490,65 @@ for (const [navn, ekstra, uden] of [['uden kontakten', {}, false], ['tastefejl } finally { A.srv.kill(); } } +// 14d (panel R3, Astra P2): et AELDRE ikon (intet «queued»), kontakten til, ventetiden loeber ud: ingen ved om mennesket +// blev spurgt - svaret siger IKKE «ask again», og loggen siger asked:null (ukendt), ikke false. +{ + const st = mkdtempSync(join(tmpdir(), 'cmcp-laan-gk-')); + const ik = await lavIkon(st); ik.svar = 'koe'; ik.laanMs = 60_000; ik.ingenKoeSvar = true; + const K1 = server(st, HJ, { CMCP_SCREEN_ASK: '0', CMCP_SCREEN_WAIT: '1' }); + const K2 = server(st, HJ, { CMCP_SCREEN_ASK: '0', CMCP_SCREEN_WAIT: '1' }); + try { + await Promise.all([K1.klar(), K2.klar()]); + await K1.kald('computer_request_screen', { action: 'request', reason: 'first', minutes: 2 }); + const b = await K2.kald('computer_request_screen', { action: 'request', reason: 'second', minutes: 2 }); + const linje = laanLog(st).filter(x => x.decision === 'denied').at(-1); + check('14d aeldre ikon uden «queued»: ventetiden loeb ud - IKKE «ask again», men det almindelige «do not ask again»', + b.fejl && !/ask again in a moment/.test(b.tekst) && /do not ask again/.test(b.tekst), b.tekst.slice(0, 160)); + check('14d ...og loggen siger asked:null (ukendt)', linje && linje.asked === null, JSON.stringify(linje || {}).slice(0, 160)); + } finally { K1.srv.kill(); K2.srv.kill(); } +} + +// 16b/c (panel R3, Astra): ikonet SIGER hvorfor laanet slutter. «taken-back» i laanets sidste sekunder er stadig et stop +// (tidsgaetningen ville misse det); «expired» tidligt er IKKE et stop. +for (const [navn, grund, efterMs, laanMs, stop] of [['16b taken-back i laanets sidste sekund', 'taken-back', 2600, 3000, true], + ['16c expired tidligt (fx et ur der sprang)', 'expired', 300, 60_000, false]]) { + const st = mkdtempSync(join(tmpdir(), 'cmcp-laan-sg-')); + const ik = await lavIkon(st); ik.svar = 'staaende'; ik.laanMs = laanMs; + const A = server(st, HJ, { CMCP_SCREEN_ASK: '0' }); + try { + await A.klar(); + const r = await A.kald('computer_request_screen', { action: 'request', reason: 'drag a file', minutes: 3 }); + await vent(efterMs); + ik.slut(grund); + await vent(400); + const igen = await A.kald('computer_request_screen', { action: 'request', reason: 'drag again', minutes: 3 }); + check(`${navn}: ${stop ? 'afvist med stop-beskeden' : 'IKKE et stop - laanet gives igen'}`, + !r.fejl && (stop ? igen.fejl && /took the screen back/.test(igen.tekst) : !igen.fejl && /"granted":\s*true/.test(igen.tekst)), igen.tekst.slice(0, 140)); + } finally { A.srv.kill(); } +} + +// 16e (panel R3, Astra): et skridt med `app`, der ventede, da mennesket tog skaermen OG gik ind i programmet - en ANDEN +// kontrol afviser foerst («the window the person is working in»), men svaret skal stadig vaere stoppet, ikke «Call it again». +{ + const st = mkdtempSync(join(tmpdir(), 'cmcp-laan-te-')); + const ik = await lavIkon(st); ik.svar = 'staaende'; ik.laanMs = 60_000; + const A = server(st, HJ, { CMCP_SCREEN_ASK: '0' }); + try { + await A.klar(); + saet({ idle: { idle: 30 } }); + await A.kald('computer_request_screen', { action: 'request', reason: 'type a note', minutes: 3 }); + await vent(700); + saet({ idle: { idle: 0.1 } }); + const skridt = A.kald('computer_type', { app: 'TextEdit', text: 'x' }); + await vent(400); + HJ.saetSvar({ apps: { apps: [{ name: 'Finder', bundleId: 'com.apple.finder', active: false }, { name: 'TextEdit', bundleId: 'com.apple.TextEdit', active: true }] }, at: AT, idle: { idle: 30 } }); + ik.slut('taken-back'); + const sv = await skridt; + check('16e skridt med app: mennesket tog skaermen og gik ind i programmet - svaret er stoppet, ikke «Call it again»', + sv.fejl && /do not request the screen again by yourself/.test(sv.tekst) && !/Call it again/.test(sv.tekst), sv.tekst.slice(0, 180)); + } finally { A.srv.kill(); saet({ idle: { idle: 30 } }); } +} + // 16 (panel R2, Astra): «tag tilbage» skal naa agenten som et STOP - et ventende skridt maa ikke svare «call it again», // og en ny anmodning uden spoergsmaal afvises med «stop og sig det i chatten» i to minutter. { @@ -531,6 +594,32 @@ for (const [navn, ekstra, uden] of [['uden kontakten', {}, false], ['tastefejl void kald; } finally { try { X.srv.kill('SIGKILL'); } catch {} saet({ idle: { idle: 30 } }); } } +// 15b (panel R3, Astra P1): den RIGTIGE hjaelper blokerer SIGTERM midt i et traek. Serveren skal saa draebe den (SIGKILL efter +// 2 s) og lade en ny hjaelper slippe knappen (release-mouse) - FOER den selv gaar. Attrappen her blokerer SIGTERM ligesom. +{ + const st = mkdtempSync(join(tmpdir(), 'cmcp-laan-ex2-')); + const ik = await lavIkon(st); ik.svar = 'staaende'; ik.laanMs = 60_000; + const X = server(st, HJ, { CMCP_SCREEN_ASK: '0' }); + try { + await X.klar(); + saet({ idle: { idle: 30 } }); + const l = await X.kald('computer_request_screen', { action: 'request', reason: 'drag a file', minutes: 3 }); + saet({ idle: { idle: 30 }, drag: { _vent: 9000, _ignorerTerm: true, dragged: true } }); + const kald = X.kald('computer_drag', { fromX: 10, fromY: 10, toX: 50, toY: 50 }).catch(() => null); + const lever = () => { try { return execFileSync('/usr/bin/pgrep', ['-f', `${dirname(HJ.sti)}/[^ ]+ drag`]).toString().trim().split('\n').filter(Boolean).length; } catch { return 0; } }; + let foer = 0; for (let i = 0; i < 30 && !foer; i++) { await vent(100); foer = lever(); } + const slip0 = HJ.handlingerNaaedeFrem().filter(k => k.argv[0] === 'release-mouse').length; + const t0 = Date.now(); + X.srv.kill('SIGTERM'); + let serverVaek = false; for (let i = 0; i < 60 && !serverVaek; i++) { await vent(100); serverVaek = X.srv.exitCode !== null || X.srv.signalCode !== null; } + const ms = Date.now() - t0; + const slip = HJ.handlingerNaaedeFrem().filter(k => k.argv[0] === 'release-mouse').length - slip0; + check('15b forudsaetning: laanet givet og traekket koerte', !l.fejl && foer >= 1, `${l.tekst.slice(0, 60)} · ${foer}`); + check('15b et traek der blokerer SIGTERM: draebt, og knappen sluppet, FOER serveren gik (ca. 2 s)', + serverVaek && lever() === 0 && slip >= 1 && ms >= 1500 && ms < 6000, `server vaek=${serverVaek} efter ${ms} ms · lever=${lever()} · release-mouse=${slip}`); + void kald; + } finally { try { X.srv.kill('SIGKILL'); } catch {} saet({ idle: { idle: 30 } }); } +} // 14c (panel R1, Opus): uden spoergsmaal er en udloebet ventetid i koeen IKKE et menneskes nej - svaret maa ikke sige // «do not ask again», men «nobody said no - ask again». To servere med kontakten, falsk ikon i koe-tilstand. diff --git a/test/stop-alle.mjs b/test/stop-alle.mjs index 712395f2..13d0a6d6 100644 --- a/test/stop-alle.mjs +++ b/test/stop-alle.mjs @@ -444,7 +444,7 @@ for (const gammel of [false, true]) { const tk = readFileSync(join(ROOT, 'helper', 'Sources', 'cmcp-status', 'Tekst.swift'), 'utf8'); const ix = readFileSync(join(ROOT, 'mcp-server', 'index.js'), 'utf8'); check('S4 menupunktet «Stop all agents now» staar der mens en agent er tilsluttet (eller har skaermen), skriver stop.json og giver et laan tilbage; serveren laeser stop.json', - /let STOP_FIL = "stop\.json"/.test(tk) && /appendingPathComponent\(STOP_FIL\)/.test(sw) && /noterKilde\("stop-all-write-failed"\) \}\n\s+aktivtLaan\?\.afslutLaan\(\)\n\s+tik\(\)/.test(sw) + /let STOP_FIL = "stop\.json"/.test(tk) && /appendingPathComponent\(STOP_FIL\)/.test(sw) && /noterKilde\("stop-all-write-failed"\) \}\n\s+aktivtLaan\?\.afslutLaan\(grund: "stopped-all"\)\n\s+tik\(\)/.test(sw) && /if !s\.isEmpty \|\| aktivtLaan != nil \{\n(\s+\/\/[^\n]*\n)*\s+let stop = NSMenuItem\(title: STOP_ALLE_TITEL, action: #selector\(stopAlle\)/.test(sw) && /#selector\(stopAlle\)/.test(sw) && /const STOP_STI = join\(dirname\(AUDIT_PATH\), 'stop\.json'\)/.test(ix)); } diff --git a/test/vagt.mjs b/test/vagt.mjs index d8d8be41..a3b7981a 100644 --- a/test/vagt.mjs +++ b/test/vagt.mjs @@ -95,6 +95,23 @@ await new Promise(r => setTimeout(r, 1500)); check('5 serveren lukkede sig selv da foraelder-skallen doede', existsSync(MAERKE), existsSync(MAERKE) ? 'ppid ved exit: ' + readFileSync(MAERKE, 'utf8') : 'stod der endnu'); +// 5c (panel R3, Astra): har processen en SIGTERM-lytter (serverens paene nedlukning, der stopper hjaelperne), bruger vagten +// DEN - ikke process.exit, som springer den over. +const MAERKE3 = join(DIR, 'lukkede3'); +const BARN3 = join(DIR, 'barn3.mjs'); +writeFileSync(BARN3, ` +import { writeFileSync, existsSync } from 'node:fs'; +import { startVagt } from ${JSON.stringify(join(ROOT, 'mcp-server', 'vagt.js'))}; +process.on('SIGTERM', () => { writeFileSync(${JSON.stringify(MAERKE3)}, 'term'); process.exit(0); }); +process.on('exit', () => { try { if (!existsSync(${JSON.stringify(MAERKE3)})) writeFileSync(${JSON.stringify(MAERKE3)}, 'exit'); } catch {} }); +startVagt({ intervalMs: 50 }); +setTimeout(() => process.exit(9), 8000); +`); +spawnSync('/bin/sh', ['-c', `${process.execPath} ${BARN3} & sleep 0.3; exit 0`], { timeout: 10000 }); +await new Promise(r => setTimeout(r, 1500)); +check('5c med en SIGTERM-lytter lukker vagten gennem den (serverens paene nedlukning)', existsSync(MAERKE3) && readFileSync(MAERKE3, 'utf8') === 'term', + existsSync(MAERKE3) ? readFileSync(MAERKE3, 'utf8') : 'stod der endnu'); + // 6. KALIBRERING DEN ANDEN VEJ: bliver skallen staaende, maa barnet blive. const MAERKE2 = join(DIR, 'lukkede2'); const BARN2 = join(DIR, 'barn2.mjs'); From f42f9ea5a8eef8b08f40f704931c34dfb29d5fcf Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Mon, 2 Nov 2026 03:49:24 +0100 Subject: [PATCH 27/94] ikon-menu 3g: en ulaeselig opstart falder lukket (simulateBootUnreadable) - P10 overlevede uden Co-Authored-By: Claude Opus 5.5 --- helper/Sources/cmcp-status/main.swift | 4 +++- test/ikon-menu.mjs | 2 ++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/helper/Sources/cmcp-status/main.swift b/helper/Sources/cmcp-status/main.swift index 3f5b1157..50e870c4 100644 --- a/helper/Sources/cmcp-status/main.swift +++ b/helper/Sources/cmcp-status/main.swift @@ -600,7 +600,9 @@ if CommandLine.arguments.contains("--dump-question") { // SPAERRING_FIL i tilstandsmappen laeses som ved ikonets start (R1: den overlever en genstart). let nu = oppetid() let fil = laesSpaerringsfil((stateDir as NSString).appendingPathComponent(SPAERRING_FIL)) - var spaerret: Double? = spaerringTilbage(filTekst: fil.tekst, laesefejl: fil.fejl, boot: bootSession(), oppetid: nu).map { nu + $0 } + // Proeve-kun: {"simulateBootUnreadable": true} = opstartens id kunne ikke laeses (sysctl fejlede). + let ulaeseligBoot = ((try? JSONSerialization.jsonObject(with: raa) as? [String: Any])?["simulateBootUnreadable"] as? Bool) == true + var spaerret: Double? = spaerringTilbage(filTekst: fil.tekst, laesefejl: fil.fejl, boot: ulaeseligBoot ? nil : bootSession(), oppetid: nu).map { nu + $0 } // R2: uret og opstarten, saa proeven kan skrive en gyldig fil - og en rundtur skriver -> laeser. ud["clock"] = ["boot": bootSession() ?? "", "uptime": nu] ud["blockFileRoundTrip"] = spaerringTilbage(filTekst: spaerringJSON(boot: bootSession() ?? "", uptimeTil: nu + 60, vaegMs: 0), laesefejl: false, diff --git a/test/ikon-menu.mjs b/test/ikon-menu.mjs index 5673e93d..d421d5f1 100644 --- a/test/ikon-menu.mjs +++ b/test/ikon-menu.mjs @@ -117,6 +117,8 @@ check('3g ...en fil der ikke er tekst (ugyldig UTF-8): spaerret', vis({ ...lan, c = nuUr(); skriv({ boot: c.boot, uptimeUntil: c.uptime + 60 }); chmodSync(SPF, 0o000); check('3g ...en fil der ikke kan laeses (ingen adgang): spaerret', vis({ ...lan, ask: false }).lendsWithoutAsking === false); chmodSync(SPF, 0o600); +c = nuUr(); skriv({ boot: c.boot, uptimeUntil: c.uptime - 1 }); +check('3g ...en udloebet fil, men opstarten kan ikke laeses: spaerret (falder lukket)', vis({ ...lan, ask: false, simulateBootUnreadable: true }).lendsWithoutAsking === false); unlinkSync(SPF); // 3h (panel R2, Opus 🔴): et laan uden spoergsmaal, der venter (spaerring, overdragelse, en anden agent), maa ikke vises som // «Allow (Touch ID)/Deny» - tavshed giver skaermen, saa kun Deny staar, i menuen og i boksen. From 912ab996c183cd249cca1973c1003179a4162819 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Mon, 2 Nov 2026 03:52:03 +0100 Subject: [PATCH 28/94] Panel R3 (Opus): et udloeb og en egen release er ikke et stop (16f), aerlig usikkerhed i stop-teksten MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - 16f: et laan der udloeber, og et agenten selv giver tilbage, giver det naeste uden spoergsmaal - Opus' M-Op1 (tagetTilbage = !laanAfgivet) overlevede foer - sagde ikonet ikke hvorfor (aeldre ikon, eller det doede), siger stop-teksten «(or the menu bar icon closed)» - spoerge-tilstandens tekst for et ventende skridt er som paa main igen Co-Authored-By: Claude Opus 5.5 --- mcp-server/index.js | 15 +++++++++------ test/skaerm-laan.mjs | 24 ++++++++++++++++++++++++ 2 files changed, 33 insertions(+), 6 deletions(-) diff --git a/mcp-server/index.js b/mcp-server/index.js index 8bac15d1..15644708 100644 --- a/mcp-server/index.js +++ b/mcp-server/index.js @@ -402,6 +402,9 @@ let laanNr = 0; let laanAfgivet = false; // R2 (Opus 🔴 + Astra): hvornaar mennesket sidst tog skaermen fra DENNE agent (0 = aldrig). Et stop skal naa agenten som et stop. let tagetTilbageVed = 0; +// R3 (Opus): sagde ikonet IKKE hvorfor (et aeldre ikon, eller et der doede), ved vi ikke, om det var mennesket. +let tagetTilbageUsikkert = false; +const tagetTilbageTekst = () => tagetTilbageUsikkert ? 'the person took the screen back from this agent (or the menu bar icon closed)' : 'the person took the screen back from this agent'; const TILBAGE_PAUSE_MS = 120_000; const TILBAGE_STOP = 'Stop, and tell them in the chat what you were doing - do not request the screen again by yourself.'; // Kun uden spoergsmaal: med spoergsmaalet afgoer mennesket hvert laan selv, og intet aendres dér. @@ -473,7 +476,7 @@ async function skaermLaan(args) { // (Touch ID) - mennesket greb ind, saa det er dem, der afgoer det naeste laan. if (nyligtTagetTilbage()) { log('denied', 'the person took the screen back from this agent less than two minutes ago'); - return errorResult(`Refused: the person took the screen back from this agent less than two minutes ago. ${TILBAGE_STOP}`); + return errorResult(`Refused: ${tagetTilbageTekst()} less than two minutes ago. ${TILBAGE_STOP}`); } const spoerg = !skaermUdenSpoergsmaal() || tagetTilbageVed > 0; const svar = await laanSkaermen({ session: SESSION, client: klientNavn(), text: laanTekst, minutter: min, spoerg }, @@ -487,7 +490,7 @@ async function skaermLaan(args) { const plan = laanTilTid(); const tagetTilbage = !laanAfgivet && (slutGrund ? (slutGrund === 'taken-back' || slutGrund === 'stopped-all') : (plan > 0 && Date.now() < plan - 1500)); - if (tagetTilbage) tagetTilbageVed = performance.now(); + if (tagetTilbage) { tagetTilbageVed = performance.now(); tagetTilbageUsikkert = !slutGrund; } saetLaan(0); laanHaandtag = null; // ⛔ Runde 1 (Astra 4): et traek eller en skrivning der er i gang, stoppes. const stoppet = afbrydSkaermKald(); @@ -1891,7 +1894,7 @@ async function haandterKald(request) { `brings an app forward, switches desktop, or raises a dialog of its own.\n` + `If this step genuinely needs the screen, ask the person to lend it to you with ` + (nyligtTagetTilbage() - ? `computer_request_screen - but the person took the screen back from this agent less than two minutes ago. ${TILBAGE_STOP}\n` + ? `computer_request_screen - but ${tagetTilbageTekst()} less than two minutes ago. ${TILBAGE_STOP}\n` : skaermUdenSpoergsmaal() && !tagetTilbageVed ? `computer_request_screen - this server borrows it without a question (CMCP_SCREEN_ASK=0), for a few minutes.\n` : `computer_request_screen - they approve it in the box in the corner of their screen (or the menu bar), for a few minutes.\n`) + @@ -2278,8 +2281,8 @@ async function haandterKald(request) { return null; } if (laanOejeblik() !== laanVedDom) { - if (nyligtTagetTilbage()) { stopTilbage = true; stopgrund = 'the person took the screen back while this waited, so it was not done'; } - else stopgrund = 'the screen loan changed while this waited (it began or ran out), so it was not done - call it again'; + if (nyligtTagetTilbage()) { stopTilbage = true; stopgrund = `${tagetTilbageTekst()} while this waited, so it was not done`; } + else stopgrund = 'the screen loan changed while this waited (it began, ended or was taken back), so it was not done - call it again'; return null; } // Runde 2 (Astra 5): kun handlinger der POSTER input flytter stemplet - efter et @@ -2296,7 +2299,7 @@ async function haandterKald(request) { ...(verdict.asker === 'menubar' ? { asker: 'menubar' } : {}), reason: stopgrund }); if (kaldStoppet()) return errorResult(`Stopped: ${stopgrund}. Ask them in the chat before you continue.`); // R3 (Astra): har mennesket taget skaermen fra agenten, er svaret et stop - uanset hvilken kontrol der afviste foerst. - if (stopTilbage || nyligtTagetTilbage()) return errorResult(`Refused: ${stopTilbage ? stopgrund : 'the person took the screen back from this agent, so it was not done'}. Nothing was done. ${TILBAGE_STOP}`); + if (stopTilbage || nyligtTagetTilbage()) return errorResult(`Refused: ${stopTilbage ? stopgrund : `${tagetTilbageTekst()}, so it was not done`}. Nothing was done. ${TILBAGE_STOP}`); return errorResult(`${stopVenter ? 'Waiting' : 'Refused'}: ${stopgrund}. Nothing was done. Call it again.`); } if (!laast.ok) { diff --git a/test/skaerm-laan.mjs b/test/skaerm-laan.mjs index c2548b78..0db40e0a 100644 --- a/test/skaerm-laan.mjs +++ b/test/skaerm-laan.mjs @@ -527,6 +527,30 @@ for (const [navn, grund, efterMs, laanMs, stop] of [['16b taken-back i laanets s } finally { A.srv.kill(); } } +// 16f (panel R3, Opus M-Op1 overlevede): et laan der UDLOEBER, og et agenten selv giver tilbage, er IKKE et stop - det +// naeste laan gives uden spoergsmaal. (Et udloeb lukkes af serverens eget ur; ikonet sender ingen grund.) +{ + const st = mkdtempSync(join(tmpdir(), 'cmcp-laan-nu-')); + const ik = await lavIkon(st); ik.svar = 'staaende'; ik.laanMs = 1200; + const A = server(st, HJ, { CMCP_SCREEN_ASK: '0' }); + try { + await A.klar(); + const r1 = await A.kald('computer_request_screen', { action: 'request', reason: 'short job', minutes: 1 }); + await vent(2000); // laanet udloeb (1,2 s) - serveren lukkede selv + const r2 = await A.kald('computer_request_screen', { action: 'request', reason: 'next job', minutes: 1 }); + check('16f et laan der udloeb: IKKE et stop - det naeste gives uden spoergsmaal', + !r1.fejl && !r2.fejl && /"granted":\s*true/.test(r2.tekst) && ik.spurgt.at(-1)?.ask === false, `${r2.tekst.slice(0, 120)} · ask=${ik.spurgt.at(-1)?.ask}`); + ik.laanMs = 60_000; + await vent(1500); + const r3 = await A.kald('computer_request_screen', { action: 'request', reason: 'third job', minutes: 1 }); + await A.kald('computer_request_screen', { action: 'release' }); + await vent(300); + const r4 = await A.kald('computer_request_screen', { action: 'request', reason: 'fourth job', minutes: 1 }); + check('16f et laan agenten selv gav tilbage: IKKE et stop - det naeste gives uden spoergsmaal', + !r3.fejl && !r4.fejl && /"granted":\s*true/.test(r4.tekst) && ik.spurgt.at(-1)?.ask === false, `${r4.tekst.slice(0, 120)} · ask=${ik.spurgt.at(-1)?.ask}`); + } finally { A.srv.kill(); } +} + // 16e (panel R3, Astra): et skridt med `app`, der ventede, da mennesket tog skaermen OG gik ind i programmet - en ANDEN // kontrol afviser foerst («the window the person is working in»), men svaret skal stadig vaere stoppet, ikke «Call it again». { From 5999c7326b68a78a17a00eea226d3aec71c7ae86 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Mon, 2 Nov 2026 04:41:03 +0100 Subject: [PATCH 29/94] Panel R4 (Opus, MAALT mod SDK 1.32.1 + Astra): nedlukningen passer ind i klientens vindue MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - serveren lukker paent allerede naar stdin slutter (klienten: stdin -> 2 s -> SIGTERM -> 2 s -> SIGKILL); stopOgVent 600 ms med nyt oejebliksbillede hver runde, og ingen NY skrivende hjaelper starter under nedlukningen; release-mouse med killSignal - 15c: en RIGTIG MCP-klient (SDK) lukker - traekket draebt, knappen sluppet, serveren gik selv (672 ms; foer 4003 ms med traekket i live). 15b uden kravet om >= 1,5 s - «tag tilbage» foer laanet var registreret er stadig et stop (16g); stoppet vinder ogsaa ved en programlaas der udloeber (16i) - kun kendte «ended»-grunde, den staerkeste vinder, forkert nonce taeller ikke (16h); loft paa 64 KB over ikonets svar - opstarts-id skal vaere et UUID, ellers ukendt = spaerret (3g) Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 7 +- helper/Sources/cmcp-status/Tekst.swift | 7 +- mcp-server/godkend.js | 8 ++- mcp-server/helper.js | 35 ++++++--- mcp-server/index.js | 15 +++- test/ikon-menu.mjs | 7 +- test/skaerm-laan.mjs | 98 +++++++++++++++++++++++++- 7 files changed, 156 insertions(+), 21 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 79967b1e..a7ca254d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -15,9 +15,10 @@ screen back now` takes it back - so do Esc and `⌃⌥⌘.` when the icon could them. Take it back, and that agent is refused for two minutes with the words to stop and tell you in the chat, and its next loan asks you; no agent gets the screen without a question for those two minutes - on a clock that does not jump, and kept if the menu -bar icon restarts (not across a restart of the Mac). A server that is ended mid-step -now stops its helpers and waits for them - two seconds, then it ends them and lets go of -a held drag - before it goes; the menu bar icon also says why a loan ended, so a take-back +bar icon restarts (not across a restart of the Mac). A server that is closed mid-step +(its client ends, a signal, or the client is gone) now stops its helpers before it goes: it +starts nothing new, gives them a moment, ends one that hangs and lets go of a held drag - +well inside the four seconds the MCP SDK's own client allows; the menu bar icon also says why a loan ended, so a take-back in the loan's last second is still a stop. A typo keeps the question. The audit log says whether you were asked. (`test/skaerm-laan.mjs` 14-16, `test/ikon-menu.mjs` 3f-3h, `test/ikon-boks.mjs` 5z) diff --git a/helper/Sources/cmcp-status/Tekst.swift b/helper/Sources/cmcp-status/Tekst.swift index 92256aaf..b9681ea1 100644 --- a/helper/Sources/cmcp-status/Tekst.swift +++ b/helper/Sources/cmcp-status/Tekst.swift @@ -202,9 +202,12 @@ func bootSession() -> String? { var buf = [CChar](repeating: 0, count: stoerrelse) guard sysctlbyname("kern.bootsessionuuid", &buf, &stoerrelse, nil, 0) == 0 else { return nil } let s = String(cString: buf) - return s.isEmpty ? nil : s + return erUUID(s) ? s : nil } +/// R4 (Astra): et opstarts-id er et UUID - alt andet er ukendt (og falder lukket). +func erUUID(_ s: String) -> Bool { s.range(of: "^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$", options: .regularExpression) != nil } + /// Linjen i SPAERRING_FIL: opstartens id + den monotone frist (systemUptime) + vaeguret til mennesker der laeser filen. func spaerringJSON(boot: String, uptimeTil: Double, vaegMs: Double) -> String { "{\"boot\":\"\(renTekst(boot))\",\"uptimeUntil\":\(uptimeTil),\"until\":\(Int(vaegMs))}\n" @@ -224,7 +227,7 @@ func spaerringTilbage(filTekst: String?, laesefejl: Bool, boot: String?, oppetid if laesefejl { return STAAENDE_PAUSE } guard let t = filTekst else { return nil } guard let d = t.data(using: .utf8), let o = try? JSONSerialization.jsonObject(with: d) as? [String: Any], - let b = o["boot"] as? String, !b.isEmpty, + let b = o["boot"] as? String, erUUID(b), let til = (o["uptimeUntil"] as? Double) ?? (o["uptimeUntil"] as? Int).map(Double.init) else { return STAAENDE_PAUSE } guard let nu = boot else { return STAAENDE_PAUSE } guard b == nu else { return nil } diff --git a/mcp-server/godkend.js b/mcp-server/godkend.js index 9514cfc6..b2814716 100644 --- a/mcp-server/godkend.js +++ b/mcp-server/godkend.js @@ -174,6 +174,7 @@ export async function spoergOmGoerSelv(sp, timeoutSec) { /// ingen fil en agent kan pille ved, og intet der skal spoerges om igen. /// Svarer { ok, grund, til, afslut } - `til` er det tidligste af vores og /// ikonets ur; `afslut` giver skaermen tilbage foer tid. +const SLUT_STYRKE = { expired: 1, 'stopped-all': 2, 'taken-back': 2 }; export async function laanSkaermen({ session, client, text, minutter, spoerg = true }, timeoutSec, slut) { // ⛔ R42 (Astra, MAALT): et afbrudt kald fik alligevel laanet, da mennesket sagde ja bagefter. if (kaldAfbrudt()) return { ok: false, grund: afbrudtGrund('nobody was asked') }; @@ -224,13 +225,16 @@ export async function laanSkaermen({ session, client, text, minutter, spoerg = t }); sock.on('data', (d) => { buf += d; + // R4 (Opus, MAALT 60 MB -> RSS 314 MB): et ikon der sender uden linjeskift, faar ikke serverens hukommelse. + if (buf.length > 65_536) { if (!svaret) afgoer({ ok: false, grund: 'the menu bar icon sent an answer that was too long' }); return sock.destroy(); } let i; while ((i = buf.indexOf('\n')) >= 0) { const linje = buf.slice(0, i); buf = buf.slice(i + 1); let m = null; try { m = JSON.parse(linje); } catch {} if (svaret) { - // R3: efter ja'et kan ikonet sige, HVORFOR laanet slutter - foer det lukker forbindelsen. - if (m && m.nonce === nonce && typeof m.ended === 'string') slutGrund = m.ended; + // R3: efter ja'et kan ikonet sige, HVORFOR laanet slutter - foer det lukker forbindelsen. R4 (Astra, Opus): kun de tre + // kendte grunde, og den staerkeste vinder (et stop overskrives ikke af et senere «expired»). + if (m && m.nonce === nonce && SLUT_STYRKE[m.ended] && SLUT_STYRKE[m.ended] >= (SLUT_STYRKE[slutGrund] || 0)) slutGrund = m.ended; continue; } // R3: et laan uden spoergsmaal, der venter i ikonets koe - ikke et svar; der ventes videre. diff --git a/mcp-server/helper.js b/mcp-server/helper.js index fbcfa347..70dfcb05 100644 --- a/mcp-server/helper.js +++ b/mcp-server/helper.js @@ -107,29 +107,44 @@ function draebBlidt(child) { ur.unref?.(); } -/// R3 (Astra P1): til en server der skal LUKKE. Stop alt der skriver - og VENT paa det: SIGTERM (paste: SIGUSR1), saa -/// SIGKILL efter `maksMs`, og et traek der maatte draebes, slippes af en ny hjaelper (synkront, hoejst 5 s). En exit-handler -/// kan ikke vente, og timerne i draebBlidt naar aldrig at koere, naar processen gaar - derfor denne vej ved et lukkesignal. -export async function stopOgVent(maksMs = 2000) { - const boern = [...levende.entries()].filter(([, argv]) => !(OPSLAG.has(argv[0]) || argv.includes('--dry'))); - for (const [child, argv] of boern) { child.afbrudtAfLaan = true; try { child.kill(argv[0] === 'paste' ? 'SIGUSR1' : 'SIGTERM'); } catch { /* vaek */ } } +/// R4 (Astra P1): naar serveren lukker, startes ingen NY skrivende hjaelper - kun opslag. +let nedlukning = false; +/// R3/R4 (Astra P1, Opus MAALT 7/7 mod SDK 1.32.1): til en server der skal LUKKE. Stop alt der skriver - og VENT: SIGTERM (paste: +/// SIGUSR1), et nyt oejebliksbillede hver runde (en hjaelper der naaede at starte, kommer med), SIGKILL efter `maksMs`, og et traek der +/// maatte draebes, slippes af en ny hjaelper. 600 ms - en MCP-klient giver kun 2 s fra SIGTERM til SIGKILL (og 2 s foer det fra stdin). +export async function stopOgVent(maksMs = 600) { + nedlukning = true; + const skriver = () => [...levende.entries()].filter(([, argv]) => !(OPSLAG.has(argv[0]) || argv.includes('--dry'))); const doed = (c) => c.exitCode !== null || c.signalCode !== null; + const signaleret = new Set(); const slut = Date.now() + maksMs; - while (Date.now() < slut && boern.some(([c]) => !doed(c))) await new Promise(r => setTimeout(r, 50)); - for (const [child, argv] of boern) { + for (;;) { + for (const [child, argv] of skriver()) { + if (signaleret.has(child)) continue; + signaleret.add(child); child.afbrudtAfLaan = true; + try { child.kill(argv[0] === 'paste' ? 'SIGUSR1' : 'SIGTERM'); } catch { /* vaek */ } + } + if (!skriver().some(([c]) => !doed(c)) || Date.now() >= slut) break; + await new Promise(r => setTimeout(r, 40)); + } + for (const [child, argv] of skriver()) { if (doed(child)) continue; try { child.kill('SIGKILL'); } catch { continue; } if (argv[0] === 'drag') { const fra = (n) => { const i = argv.indexOf(n); return i >= 0 ? String(argv[i + 1]) : null; }; const start = fra('--from-x') && fra('--from-y') ? ['--from-x', fra('--from-x'), '--from-y', fra('--from-y')] : []; - try { execFileSync(helperPath(), ['release-mouse', ...start], { timeout: 5000, stdio: 'ignore' }); } catch { /* ingen hjaelper */ } + try { execFileSync(helperPath(), ['release-mouse', ...start], { timeout: 2000, killSignal: 'SIGKILL', stdio: 'ignore' }); } catch { /* ingen hjaelper */ } } } - return boern.length; + return signaleret.size; } export function callHelper(args, { timeout = 30000, stdin = null } = {}) { return new Promise((resolve, reject) => { + // R4 (Astra P1): under nedlukningen startes intet nyt, der skriver. + if (nedlukning && !(OPSLAG.has(args[0]) || args.includes('--dry'))) { + return reject(new HelperError('the server is shutting down, so nothing new was started', 'shutting-down')); + } const bin = helperPath(); if (!bin) { return reject(new HelperError( diff --git a/mcp-server/index.js b/mcp-server/index.js index 15644708..959ee6b0 100644 --- a/mcp-server/index.js +++ b/mcp-server/index.js @@ -483,7 +483,13 @@ async function skaermLaan(args) { skaermVentetid(), async (slutGrund) => { // Forbindelsen er lukket: tiden gik, mennesket tog skaermen, ikonet doede, // eller agenten gav den tilbage. Kun DETTE laans slut taeller. - if (nr === null) { lukketFoerStart = true; return; } + // R4 (Astra P1): tog mennesket skaermen, foer laanet var registreret (mens ja'ets maaling stadig koerte), er det stadig et + // stop - kun en GRUND fra ikonet taeller her (et kald serveren selv afbryder, lukker ogsaa uden grund). + if (nr === null) { + lukketFoerStart = true; + if (slutGrund === 'taken-back' || slutGrund === 'stopped-all') { tagetTilbageVed = performance.now(); tagetTilbageUsikkert = false; } + return; + } if (nr !== laanNr) return; // R3 (Astra): ikonet siger HVORFOR (taken-back / stopped-all / expired). Kun uden grund (et aeldre ikon, eller et // ikon der doede) gaettes der: sluttede laanet foer tid, og ikke fordi agenten gav det tilbage = taget tilbage. @@ -2309,6 +2315,8 @@ async function haandterKald(request) { : laast.grund || `another agent is working in ${targetBundleId || 'the foreground app'} right now, and it did not finish within the time this call has`; record({ tool: name, outcome: 'refused', reason: grund }); if (kaldStoppet()) return errorResult(`Stopped: ${grund}. Ask them in the chat before you continue.`); + // R4 (Astra P2): ogsaa her vinder et «tag tilbage» - aldrig «try again» efter et stop. + if (nyligtTagetTilbage()) return errorResult(`Refused: ${tagetTilbageTekst()}, so it was not done. Nothing was done. ${TILBAGE_STOP}`); return errorResult(`Refused: ${grund}. Nothing was done. Try again shortly.`); } result = laast.vaerdi; @@ -2428,8 +2436,11 @@ statusStart({ session: SESSION, client: process.env.CMCP_CLIENT, version: PKG.ve // traek), foer serveren gaar. Erstatter baade linjen tidligere i filen og status.js' egen exit(0) (registreret i statusStart) - // status.js rydder stadig sin fil i sin 'exit'-lytter. Samme vej, naar klienten er vaek (startVagt). let lukker = false; -const lukPaent = () => { if (lukker) return; lukker = true; stopOgVent(2000).catch(() => {}).finally(() => process.exit(0)); }; +const lukPaent = () => { if (lukker) return; lukker = true; stopOgVent(600).catch(() => {}).finally(() => process.exit(0)); }; for (const sig of ['SIGTERM', 'SIGINT', 'SIGHUP']) { process.removeAllListeners(sig); process.on(sig, lukPaent); } +// R4 (Opus, MAALT mod SDK 1.32.1): klienten lukker ved at slutte stdin, venter 2 s, sender SIGTERM og 2 s efter SIGKILL. Serveren +// begynder at lukke allerede ved stdin's slut - saa har den hele vinduet til at stoppe sine hjaelpere. +process.stdin.on('end', lukPaent); // Doer chatten, doer serveren med. Stdin lukker normalt foerst - men en klient // der bliver draebt, lukker ingenting, og serveren staar tilbage med // tilgaengeligheds-rettigheder og taeller med i «hvor mange agenter koerer». diff --git a/test/ikon-menu.mjs b/test/ikon-menu.mjs index d421d5f1..17657647 100644 --- a/test/ikon-menu.mjs +++ b/test/ikon-menu.mjs @@ -104,7 +104,7 @@ let c = nuUr(); skriv({ boot: c.boot, uptimeUntil: c.uptime + 60 }); check('3g spaerringen fra et tidligere ikon (60 s tilbage, samme opstart) gaelder efter genstart', vis({ ...lan, ask: false }).lendsWithoutAsking === false); c = nuUr(); skriv({ boot: c.boot, uptimeUntil: c.uptime - 1 }); check('3g ...udloebet (samme opstart): gives', vis({ ...lan, ask: false }).lendsWithoutAsking === true); -c = nuUr(); skriv({ boot: 'en-anden-opstart', uptimeUntil: c.uptime + 60 }); +c = nuUr(); skriv({ boot: '00000000-0000-4000-8000-000000000000', uptimeUntil: c.uptime + 60 }); check('3g ...fra en ANDEN opstart af Mac\'en: ingen spaerring', vis({ ...lan, ask: false }).lendsWithoutAsking === true); c = nuUr(); skriv({ boot: c.boot, uptimeUntil: c.uptime + 10 * 86_400 }); const v10 = vis({ ...lan, ask: false }); @@ -119,6 +119,11 @@ check('3g ...en fil der ikke kan laeses (ingen adgang): spaerret', vis({ ...lan, chmodSync(SPF, 0o600); c = nuUr(); skriv({ boot: c.boot, uptimeUntil: c.uptime - 1 }); check('3g ...en udloebet fil, men opstarten kan ikke laeses: spaerret (falder lukket)', vis({ ...lan, ask: false, simulateBootUnreadable: true }).lendsWithoutAsking === false); +// R4 (Opus MS2, Astra): et opstarts-id der ikke er et UUID («», noget andet), er ukendt - spaerret. +for (const b of ['', 'ikke-et-uuid']) { + c = nuUr(); skriv({ boot: b, uptimeUntil: c.uptime - 1 }); + check(`3g ...opstarts-id «${b}» i filen: spaerret (falder lukket)`, vis({ ...lan, ask: false }).lendsWithoutAsking === false); +} unlinkSync(SPF); // 3h (panel R2, Opus 🔴): et laan uden spoergsmaal, der venter (spaerring, overdragelse, en anden agent), maa ikke vises som // «Allow (Touch ID)/Deny» - tavshed giver skaermen, saa kun Deny staar, i menuen og i boksen. diff --git a/test/skaerm-laan.mjs b/test/skaerm-laan.mjs index 0db40e0a..ad442b8a 100644 --- a/test/skaerm-laan.mjs +++ b/test/skaerm-laan.mjs @@ -68,6 +68,8 @@ function lavIkon(state) { } else if (ikon.svar === 'staaende') { // 2/11: mennesket har slaaet spoergsmaalet fra - ikonet giver straks sock.write(JSON.stringify({ nonce: q.nonce, ok: true, verified: 'standing', until: Date.now() + ikon.laanMs }) + '\n'); ikon.laan = sock; ikon.laanNonce = q.nonce; sock.on('end', () => { ikon.lukketAfServer++; }); + // R4: «straksTilbage» - mennesket tager skaermen, mens serveren stadig behandler ja'et (maalingen koerer op til 1,5 s). + if (ikon.straksTilbage) { sock.write(JSON.stringify({ nonce: q.nonce, ended: 'taken-back' }) + '\n'); setTimeout(() => sock.destroy(), 5); } } else if (ikon.svar === 'ja') { sock.write(JSON.stringify({ nonce: q.nonce, ok: true, verified: 'owner', until: Date.now() + ikon.laanMs }) + '\n'); ikon.laan = sock; // forbindelsen holdes AABEN: den er laanet @@ -508,6 +510,41 @@ for (const [navn, ekstra, uden] of [['uden kontakten', {}, false], ['tastefejl } finally { K1.srv.kill(); K2.srv.kill(); } } +// 15c (panel R4, Opus, MAALT 7/7): en RIGTIG MCP-klient lukker saadan (SDK 1.32.1, client/stdio.js): stdin slutter -> 2 s -> +// SIGTERM -> 2 s -> SIGKILL. Det fastlaaste traek skal vaere draebt og knappen sluppet, foer klienten draeber serveren. +{ + const { Client } = await import(join(ROOT, 'mcp-server', 'node_modules', '@modelcontextprotocol', 'sdk', 'dist', 'esm', 'client', 'index.js')); + const { StdioClientTransport } = await import(join(ROOT, 'mcp-server', 'node_modules', '@modelcontextprotocol', 'sdk', 'dist', 'esm', 'client', 'stdio.js')); + const st = mkdtempSync(join(tmpdir(), 'cmcp-laan-sdk-')); + const ik = await lavIkon(st); ik.svar = 'staaende'; ik.laanMs = 60_000; + const sp = lavFalskSpoerger('ja', 'cmcp-laan-sdk-sp'); + const env = { ...process.env, CMCP_STATE_DIR: st, CMCP_MODE: 'allow', CMCP_HELPER: HJ.sti, CMCP_MENNESKE_SEK: '5', CMCP_ASK_TIMEOUT: '3', + CMCP_STATUS_IKON: '0', CMCP_OSASCRIPT: sp.sti, CMCP_SCREEN_ASK: '0' }; + delete env.CMCP_BACKGROUND; + const tr = new StdioClientTransport({ command: process.execPath, args: [join(ROOT, 'mcp-server', 'index.js')], env, stderr: 'ignore' }); + const kl = new Client({ name: 'sdk-luk', version: '1' }); + try { + await kl.connect(tr); + saet({ idle: { idle: 30 } }); + const l = await kl.callTool({ name: 'computer_request_screen', arguments: { action: 'request', reason: 'drag a file', minutes: 3 } }); + saet({ idle: { idle: 30 }, drag: { _vent: 9000, _ignorerTerm: true, dragged: true } }); + kl.callTool({ name: 'computer_drag', arguments: { fromX: 10, fromY: 10, toX: 50, toY: 50 } }).catch(() => null); + const lever = () => { try { return execFileSync('/usr/bin/pgrep', ['-f', `${dirname(HJ.sti)}/[^ ]+ drag`]).toString().trim().split('\n').filter(Boolean).length; } catch { return 0; } }; + let foer = 0; for (let i = 0; i < 30 && !foer; i++) { await vent(100); foer = lever(); } + const slip0 = HJ.handlingerNaaedeFrem().filter(k => k.argv[0] === 'release-mouse').length; + const pid = tr.pid; + const t0 = Date.now(); + await kl.close(); + const ms = Date.now() - t0; + await vent(300); + const slip = HJ.handlingerNaaedeFrem().filter(k => k.argv[0] === 'release-mouse').length - slip0; + let serverLever = true; try { process.kill(pid, 0); } catch { serverLever = false; } + check('15c forudsaetning: laanet givet og traekket koerte', !l.isError && foer >= 1, `${JSON.stringify(l.content?.[0]?.text || '').slice(0, 60)} · ${foer}`); + check('15c en rigtig MCP-klient lukker: traekket draebt og knappen sluppet, og serveren gik selv (foer SIGKILL efter 4 s)', + lever() === 0 && slip >= 1 && !serverLever && ms < 3900, `close ${ms} ms · traek lever=${lever()} · release-mouse=${slip} · server lever=${serverLever}`); + } finally { try { await kl.close(); } catch {} saet({ idle: { idle: 30 } }); } +} + // 16b/c (panel R3, Astra): ikonet SIGER hvorfor laanet slutter. «taken-back» i laanets sidste sekunder er stadig et stop // (tidsgaetningen ville misse det); «expired» tidligt er IKKE et stop. for (const [navn, grund, efterMs, laanMs, stop] of [['16b taken-back i laanets sidste sekund', 'taken-back', 2600, 3000, true], @@ -527,6 +564,61 @@ for (const [navn, grund, efterMs, laanMs, stop] of [['16b taken-back i laanets s } finally { A.srv.kill(); } } +// 16g (panel R4, Astra P1): mennesket tager skaermen, MENS serveren stadig behandler ja'et - stadig et stop. +{ + const st = mkdtempSync(join(tmpdir(), 'cmcp-laan-tidl-')); + const ik = await lavIkon(st); ik.svar = 'staaende'; ik.laanMs = 60_000; ik.straksTilbage = true; + const A = server(st, HJ, { CMCP_SCREEN_ASK: '0' }); + try { + await A.klar(); + const r1 = await A.kald('computer_request_screen', { action: 'request', reason: 'quick drag', minutes: 1 }); + ik.straksTilbage = false; + const r2 = await A.kald('computer_request_screen', { action: 'request', reason: 'quick drag again', minutes: 1 }); + check('16g forudsaetning: laanet blev taget tilbage i samme oejeblik, som det blev givet', r1.fejl && /taken back the moment it was given/.test(r1.tekst), r1.tekst.slice(0, 100)); + check('16g taget tilbage foer laanet var registreret: den naeste anmodning faar stop-beskeden (ikke et nyt laan uden spoergsmaal)', + r2.fejl && /took the screen back/.test(r2.tekst) && /do not request the screen again by yourself/.test(r2.tekst), `${r1.tekst.slice(0, 70)} · ${r2.tekst.slice(0, 110)}`); + } finally { A.srv.kill(); } +} + +// 16h (panel R4, Opus MC overlevede): en «ended»-linje med forkert nonce taeller ikke, og den staerkeste grund vinder. +for (const [navn, linjer, stop] of [['16h forkert nonce paa «taken-back», saa «expired»: IKKE et stop', [['forkert', 'taken-back'], [null, 'expired']], false], + ['16h «taken-back» og bagefter «expired» (samme nonce): stoppet vinder', [[null, 'taken-back'], [null, 'expired']], true]]) { + const st = mkdtempSync(join(tmpdir(), 'cmcp-laan-nc-')); + const ik = await lavIkon(st); ik.svar = 'staaende'; ik.laanMs = 60_000; + const A = server(st, HJ, { CMCP_SCREEN_ASK: '0' }); + try { + await A.klar(); + await A.kald('computer_request_screen', { action: 'request', reason: 'job', minutes: 1 }); + await vent(1700); + for (const [nonce, grund] of linjer) ik.laan.write(JSON.stringify({ nonce: nonce || ik.laanNonce, ended: grund }) + '\n'); + setTimeout(() => ik.laan.destroy(), 30); + await vent(400); + const igen = await A.kald('computer_request_screen', { action: 'request', reason: 'job again', minutes: 1 }); + check(navn, stop ? igen.fejl && /took the screen back/.test(igen.tekst) : !igen.fejl && /"granted":\s*true/.test(igen.tekst), igen.tekst.slice(0, 120)); + } finally { A.srv.kill(); } +} + +// 16i (panel R4, Astra P2): et skridt der venter paa en ANDEN agents programlaas, da mennesket tager skaermen - naar laasens ventetid +// udloeber, er svaret stoppet, ikke «Try again shortly». +{ + const st = mkdtempSync(join(tmpdir(), 'cmcp-laan-pl-')); + const ik = await lavIkon(st); ik.svar = 'staaende'; ik.laanMs = 60_000; + const A = server(st, HJ, { CMCP_SCREEN_ASK: '0', CMCP_CALL_BUDGET: '4' }); + try { + await A.klar(); + saet({ idle: { idle: 30 } }); + await A.kald('computer_request_screen', { action: 'request', reason: 'type a note', minutes: 3 }); + mkdirSync(join(st, 'laase'), { recursive: true }); + writeFileSync(join(st, 'laase', 'com.apple.TextEdit.lock'), String(process.pid)); // en anden levende agent holder laasen + const skridt = A.kald('computer_type', { app: 'TextEdit', text: 'x' }); + await vent(900); + ik.slut('taken-back'); + const sv = await skridt; + check('16i laasens ventetid udloeb efter «tag tilbage»: stoppet, ikke «Try again shortly»', + sv.fejl && /do not request the screen again by yourself/.test(sv.tekst) && !/Try again shortly/.test(sv.tekst), sv.tekst.slice(0, 160)); + } finally { A.srv.kill(); try { unlinkSync(join(st, 'laase', 'com.apple.TextEdit.lock')); } catch {} } +} + // 16f (panel R3, Opus M-Op1 overlevede): et laan der UDLOEBER, og et agenten selv giver tilbage, er IKKE et stop - det // naeste laan gives uden spoergsmaal. (Et udloeb lukkes af serverens eget ur; ikonet sender ingen grund.) { @@ -635,12 +727,16 @@ for (const [navn, grund, efterMs, laanMs, stop] of [['16b taken-back i laanets s const slip0 = HJ.handlingerNaaedeFrem().filter(k => k.argv[0] === 'release-mouse').length; const t0 = Date.now(); X.srv.kill('SIGTERM'); + const type0 = HJ.handlingerNaaedeFrem().filter(k => k.argv[0] === 'type').length; + X.kald('computer_type', { app: 'TextEdit', text: 'ny skrivning under nedlukningen' }).catch(() => null); // R4 (Astra P1) let serverVaek = false; for (let i = 0; i < 60 && !serverVaek; i++) { await vent(100); serverVaek = X.srv.exitCode !== null || X.srv.signalCode !== null; } const ms = Date.now() - t0; const slip = HJ.handlingerNaaedeFrem().filter(k => k.argv[0] === 'release-mouse').length - slip0; check('15b forudsaetning: laanet givet og traekket koerte', !l.fejl && foer >= 1, `${l.tekst.slice(0, 60)} · ${foer}`); + check('15b under nedlukningen starter ingen NY skrivende hjaelper', HJ.handlingerNaaedeFrem().filter(k => k.argv[0] === 'type').length === type0, + `${HJ.handlingerNaaedeFrem().filter(k => k.argv[0] === 'type').length - type0} nye`); check('15b et traek der blokerer SIGTERM: draebt, og knappen sluppet, FOER serveren gik (ca. 2 s)', - serverVaek && lever() === 0 && slip >= 1 && ms >= 1500 && ms < 6000, `server vaek=${serverVaek} efter ${ms} ms · lever=${lever()} · release-mouse=${slip}`); + serverVaek && lever() === 0 && slip >= 1 && ms < 4000, `server vaek=${serverVaek} efter ${ms} ms · lever=${lever()} · release-mouse=${slip}`); void kald; } finally { try { X.srv.kill('SIGKILL'); } catch {} saet({ idle: { idle: 30 } }); } } From 4f9f280c80bbd8f51809317cf3a90fc70e270787 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Mon, 2 Nov 2026 04:59:00 +0100 Subject: [PATCH 30/94] =?UTF-8?q?15b/15c=20binder=20nedlukningens=20to=20v?= =?UTF-8?q?agter:=20=C2=ABshutting=20down=C2=BB-afvisningen=20og=20stdin-l?= =?UTF-8?q?ytteren?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Q3 (flaget fjernet) overlevede, fordi nedlukningens nye oejebliksbillede draebte den nye hjaelper alligevel; nu kraeves afvisningen. Q1 (stdin ignoreret) overlevede, fordi SIGTERM- vejen ogsaa naaede det paa 600 ms; nu kraeves at serveren gaar foer klientens SIGTERM. Co-Authored-By: Claude Opus 5.5 --- test/skaerm-laan.mjs | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/test/skaerm-laan.mjs b/test/skaerm-laan.mjs index ad442b8a..9774cdc5 100644 --- a/test/skaerm-laan.mjs +++ b/test/skaerm-laan.mjs @@ -540,8 +540,8 @@ for (const [navn, ekstra, uden] of [['uden kontakten', {}, false], ['tastefejl const slip = HJ.handlingerNaaedeFrem().filter(k => k.argv[0] === 'release-mouse').length - slip0; let serverLever = true; try { process.kill(pid, 0); } catch { serverLever = false; } check('15c forudsaetning: laanet givet og traekket koerte', !l.isError && foer >= 1, `${JSON.stringify(l.content?.[0]?.text || '').slice(0, 60)} · ${foer}`); - check('15c en rigtig MCP-klient lukker: traekket draebt og knappen sluppet, og serveren gik selv (foer SIGKILL efter 4 s)', - lever() === 0 && slip >= 1 && !serverLever && ms < 3900, `close ${ms} ms · traek lever=${lever()} · release-mouse=${slip} · server lever=${serverLever}`); + check('15c en rigtig MCP-klient lukker: traekket draebt og knappen sluppet, og serveren gik selv - allerede da stdin sluttede (foer klientens SIGTERM efter 2 s)', + lever() === 0 && slip >= 1 && !serverLever && ms < 1900, `close ${ms} ms · traek lever=${lever()} · release-mouse=${slip} · server lever=${serverLever}`); } finally { try { await kl.close(); } catch {} saet({ idle: { idle: 30 } }); } } @@ -728,13 +728,13 @@ for (const [navn, linjer, stop] of [['16h forkert nonce paa «taken-back», saa const t0 = Date.now(); X.srv.kill('SIGTERM'); const type0 = HJ.handlingerNaaedeFrem().filter(k => k.argv[0] === 'type').length; - X.kald('computer_type', { app: 'TextEdit', text: 'ny skrivning under nedlukningen' }).catch(() => null); // R4 (Astra P1) + let nySvar = null; X.kald('computer_type', { app: 'TextEdit', text: 'ny skrivning under nedlukningen' }).then(r => { nySvar = r; }, e => { nySvar = { fejl: true, tekst: String(e) }; }); // R4 (Astra P1) let serverVaek = false; for (let i = 0; i < 60 && !serverVaek; i++) { await vent(100); serverVaek = X.srv.exitCode !== null || X.srv.signalCode !== null; } const ms = Date.now() - t0; const slip = HJ.handlingerNaaedeFrem().filter(k => k.argv[0] === 'release-mouse').length - slip0; check('15b forudsaetning: laanet givet og traekket koerte', !l.fejl && foer >= 1, `${l.tekst.slice(0, 60)} · ${foer}`); - check('15b under nedlukningen starter ingen NY skrivende hjaelper', HJ.handlingerNaaedeFrem().filter(k => k.argv[0] === 'type').length === type0, - `${HJ.handlingerNaaedeFrem().filter(k => k.argv[0] === 'type').length - type0} nye`); + check('15b under nedlukningen starter ingen NY skrivende hjaelper - den afvises med «shutting down»', HJ.handlingerNaaedeFrem().filter(k => k.argv[0] === 'type').length === type0 && /shutting down/.test(nySvar?.tekst || ''), + `${HJ.handlingerNaaedeFrem().filter(k => k.argv[0] === 'type').length - type0} nye · svar: ${JSON.stringify(nySvar).slice(0, 160)}`); check('15b et traek der blokerer SIGTERM: draebt, og knappen sluppet, FOER serveren gik (ca. 2 s)', serverVaek && lever() === 0 && slip >= 1 && ms < 4000, `server vaek=${serverVaek} efter ${ms} ms · lever=${lever()} · release-mouse=${slip}`); void kald; From 60e391c52ee392b7a965210e48664ef4d9204535 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Mon, 2 Nov 2026 05:40:08 +0100 Subject: [PATCH 31/94] =?UTF-8?q?Efter=20R5=20(begge=20GODKENDT):=20typeva?= =?UTF-8?q?gt=20paa=20=C2=ABended=C2=BB,=20intet=20nyt=20under=20nedluknin?= =?UTF-8?q?g,=20proeve=20paa=2064=20KB-loftet?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - {ended: {toString: null}} fik serveren til at gaa ned (MAALT, 16h2); kun en tekst og kun en af de tre egne noegler taeller nu, og et array kan ikke overskrive et stop - under nedlukningen afvises ENHVER ny skrivende handling, ogsaa en optagelse, foer noget spoergsmaal stilles (15b; Opus F1) - 16j binder 64 KB-loftet (Opus MX4 overlevede) - CHANGELOG siger praecist, hvad nedlukningen goer og ikke goer Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 7 ++++--- mcp-server/godkend.js | 4 +++- mcp-server/helper.js | 1 + mcp-server/index.js | 7 ++++++- test/skaerm-laan.mjs | 39 +++++++++++++++++++++++++++++++++++++++ 5 files changed, 53 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index a7ca254d..33d444e7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -16,9 +16,10 @@ them. Take it back, and that agent is refused for two minutes with the words to and tell you in the chat, and its next loan asks you; no agent gets the screen without a question for those two minutes - on a clock that does not jump, and kept if the menu bar icon restarts (not across a restart of the Mac). A server that is closed mid-step -(its client ends, a signal, or the client is gone) now stops its helpers before it goes: it -starts nothing new, gives them a moment, ends one that hangs and lets go of a held drag - -well inside the four seconds the MCP SDK's own client allows; the menu bar icon also says why a loan ended, so a take-back +(its client ends, a signal, or the client is gone) now stops what it is doing before it goes: it +starts nothing new that types, clicks or records, gives its writing helpers a moment, ends +one that hangs and lets go of a held drag - measured well inside the four seconds the MCP +SDK's own client allows (a helper that is only looking can outlive it); the menu bar icon also says why a loan ended, so a take-back in the loan's last second is still a stop. A typo keeps the question. The audit log says whether you were asked. (`test/skaerm-laan.mjs` 14-16, `test/ikon-menu.mjs` 3f-3h, `test/ikon-boks.mjs` 5z) diff --git a/mcp-server/godkend.js b/mcp-server/godkend.js index b2814716..a3af8a84 100644 --- a/mcp-server/godkend.js +++ b/mcp-server/godkend.js @@ -234,7 +234,9 @@ export async function laanSkaermen({ session, client, text, minutter, spoerg = t if (svaret) { // R3: efter ja'et kan ikonet sige, HVORFOR laanet slutter - foer det lukker forbindelsen. R4 (Astra, Opus): kun de tre // kendte grunde, og den staerkeste vinder (et stop overskrives ikke af et senere «expired»). - if (m && m.nonce === nonce && SLUT_STYRKE[m.ended] && SLUT_STYRKE[m.ended] >= (SLUT_STYRKE[slutGrund] || 0)) slutGrund = m.ended; + // R5 (Astra, MAALT: {toString:null} fik serveren til at gaa ned): kun en TEKST, og kun en af de tre egne noegler. + if (m && m.nonce === nonce && typeof m.ended === 'string' && Object.hasOwn(SLUT_STYRKE, m.ended) + && SLUT_STYRKE[m.ended] >= (SLUT_STYRKE[slutGrund] || 0)) slutGrund = m.ended; continue; } // R3: et laan uden spoergsmaal, der venter i ikonets koe - ikke et svar; der ventes videre. diff --git a/mcp-server/helper.js b/mcp-server/helper.js index 70dfcb05..75b615a1 100644 --- a/mcp-server/helper.js +++ b/mcp-server/helper.js @@ -109,6 +109,7 @@ function draebBlidt(child) { /// R4 (Astra P1): naar serveren lukker, startes ingen NY skrivende hjaelper - kun opslag. let nedlukning = false; +export const nedlukningIGang = () => nedlukning; /// R3/R4 (Astra P1, Opus MAALT 7/7 mod SDK 1.32.1): til en server der skal LUKKE. Stop alt der skriver - og VENT: SIGTERM (paste: /// SIGUSR1), et nyt oejebliksbillede hver runde (en hjaelper der naaede at starte, kommer med), SIGKILL efter `maksMs`, og et traek der /// maatte draebes, slippes af en ny hjaelper. 600 ms - en MCP-klient giver kun 2 s fra SIGTERM til SIGKILL (og 2 s foer det fra stdin). diff --git a/mcp-server/index.js b/mcp-server/index.js index 959ee6b0..fc1cac60 100644 --- a/mcp-server/index.js +++ b/mcp-server/index.js @@ -26,7 +26,7 @@ import { TOOLS, TOOL_BY_NAME, describe } from './tools.js'; import { spoergOmGoerSelv, laanSkaermen, tagMaaling, iHandling, handlingVenterStadig, kaldAfbrudt, restMs, stopAlleKald, kaldStoppet, afbrudtGrund } from './godkend.js'; import { BESKED_APPS, beskedSlags, WEBMAIL, WEBCHAT, SENDE_ORD, tastSender, saetLaan, laanAktivt, laanTilTid, baggrundLaast, laanOejeblik } from './policy.js'; import { TIER, ALWAYS_ASK_APPS, SPOERG_PR_SESSION, decide, currentMode, askHumanToDo, askTimeout, skaermVentetid, skaermUdenSpoergsmaal, menuSerFarlig, tastSerFarlig, baggrund, TAGER_SKAERMEN, KAN_STILLES, MANGLER_FOR_STILLE, kaldErStille, tagerSkaermen, resetSession, glemSessionsProgrammer, isSessionGranted, sessionsProgrammer } from './policy.js'; -import { callHelper, HelperError, helperPath, frontmostBundleId, resolveBundleId, resolveApp, resolveAppStrict, afbrydSkaermKald, stopOgVent } from './helper.js'; +import { callHelper, HelperError, helperPath, frontmostBundleId, resolveBundleId, resolveApp, resolveAppStrict, afbrydSkaermKald, stopOgVent, nedlukningIGang } from './helper.js'; import { record, scrubArgs, kendNoegler, fingerprint, AUDIT_PATH, noterVentende, ventende, KOE_PATH, kaedenHolder, SESSION, loggenKanSkrives, iKald } from './audit.js'; import { medProgramLaas } from './programlaas.js'; import { taelOgTael } from './sloejfe.js'; @@ -1506,6 +1506,11 @@ async function haandterKald(request) { // R45 (Opus B, MAALT P1): samme vaegt som porten bruger - en optagestart og et usloeret skaermbillede er skrivende. const skriver = tool && (tool.tier !== TIER.READ || (name === 'computer_record' && args.action === 'start') || (name === 'computer_screenshot' && args.redact === false)); + // R5 (Opus F1): under nedlukningen begynder intet nyt, der skriver - heller ikke en optagelse, og intet spoergsmaal stilles. + if (skriver && nedlukningIGang() && !(name === 'computer_request_screen' && args.action !== 'request')) { + record({ tool: name, decision: 'denied', reason: 'the server is shutting down' }); + return errorResult('Refused: the server is shutting down, so nothing new was started.'); + } if (skriver && pauseIGang() && !(name === 'computer_request_screen' && args.action !== 'request')) { record({ tool: name, decision: 'stopped', reason: 'Stop all agents now' }); diff --git a/test/skaerm-laan.mjs b/test/skaerm-laan.mjs index 9774cdc5..081d9249 100644 --- a/test/skaerm-laan.mjs +++ b/test/skaerm-laan.mjs @@ -598,6 +598,43 @@ for (const [navn, linjer, stop] of [['16h forkert nonce paa «taken-back», saa } finally { A.srv.kill(); } } +// 16h2 (panel R5, Astra): en «ended», der ikke er en tekst, taeller ikke - et array kan ikke overskrive et rigtigt stop, og et +// objekt uden toString faar ikke serveren til at gaa ned. +{ + const st = mkdtempSync(join(tmpdir(), 'cmcp-laan-ty-')); + const ik = await lavIkon(st); ik.svar = 'staaende'; ik.laanMs = 60_000; + const A = server(st, HJ, { CMCP_SCREEN_ASK: '0' }); + try { + await A.klar(); + await A.kald('computer_request_screen', { action: 'request', reason: 'job', minutes: 1 }); + await vent(1700); + ik.laan.write(JSON.stringify({ nonce: ik.laanNonce, ended: { toString: null } }) + '\n'); + ik.laan.write(JSON.stringify({ nonce: ik.laanNonce, ended: 'taken-back' }) + '\n'); + ik.laan.write(JSON.stringify({ nonce: ik.laanNonce, ended: ['taken-back'] }) + '\n'); + setTimeout(() => ik.laan.destroy(), 30); + await vent(400); + const lever = A.srv.exitCode === null && A.srv.signalCode === null; + const igen = lever ? await A.kald('computer_request_screen', { action: 'request', reason: 'job again', minutes: 1 }) : { fejl: true, tekst: 'serveren doede' }; + check('16h2 en «ended» der ikke er tekst: serveren lever, og det rigtige stop staar', lever && igen.fejl && /took the screen back/.test(igen.tekst), igen.tekst.slice(0, 120)); + } finally { A.srv.kill(); } +} + +// 16j (panel R5, Opus F3, MAALT 60 MB -> 263 MB uden loft): et ikon der sender uden linjeskift, faar ikke serverens hukommelse - +// forbindelsen lukkes, og laanet er slut. +{ + const st = mkdtempSync(join(tmpdir(), 'cmcp-laan-bf-')); + const ik = await lavIkon(st); ik.svar = 'staaende'; ik.laanMs = 60_000; + const A = server(st, HJ, { CMCP_SCREEN_ASK: '0' }); + try { + await A.klar(); + await A.kald('computer_request_screen', { action: 'request', reason: 'job', minutes: 1 }); + ik.laan.write('x'.repeat(70_000)); + await vent(500); + const st2 = await A.kald('computer_request_screen', { action: 'status' }); + check('16j over 64 KB uden linjeskift: forbindelsen lukket, laanet slut', /background/.test(st2.tekst) && A.srv.exitCode === null, st2.tekst.slice(0, 100)); + } finally { A.srv.kill(); } +} + // 16i (panel R4, Astra P2): et skridt der venter paa en ANDEN agents programlaas, da mennesket tager skaermen - naar laasens ventetid // udloeber, er svaret stoppet, ikke «Try again shortly». { @@ -729,12 +766,14 @@ for (const [navn, linjer, stop] of [['16h forkert nonce paa «taken-back», saa X.srv.kill('SIGTERM'); const type0 = HJ.handlingerNaaedeFrem().filter(k => k.argv[0] === 'type').length; let nySvar = null; X.kald('computer_type', { app: 'TextEdit', text: 'ny skrivning under nedlukningen' }).then(r => { nySvar = r; }, e => { nySvar = { fejl: true, tekst: String(e) }; }); // R4 (Astra P1) + let nyOptag = null; X.kald('computer_record', { action: 'start' }).then(r => { nyOptag = r; }, e => { nyOptag = { fejl: true, tekst: String(e) }; }); // R5 (Opus F1) let serverVaek = false; for (let i = 0; i < 60 && !serverVaek; i++) { await vent(100); serverVaek = X.srv.exitCode !== null || X.srv.signalCode !== null; } const ms = Date.now() - t0; const slip = HJ.handlingerNaaedeFrem().filter(k => k.argv[0] === 'release-mouse').length - slip0; check('15b forudsaetning: laanet givet og traekket koerte', !l.fejl && foer >= 1, `${l.tekst.slice(0, 60)} · ${foer}`); check('15b under nedlukningen starter ingen NY skrivende hjaelper - den afvises med «shutting down»', HJ.handlingerNaaedeFrem().filter(k => k.argv[0] === 'type').length === type0 && /shutting down/.test(nySvar?.tekst || ''), `${HJ.handlingerNaaedeFrem().filter(k => k.argv[0] === 'type').length - type0} nye · svar: ${JSON.stringify(nySvar).slice(0, 160)}`); + check('15b ...heller ingen NY optagelse - den afvises med «shutting down» (R5, Opus F1)', /shutting down/.test(nyOptag?.tekst || ''), JSON.stringify(nyOptag).slice(0, 160)); check('15b et traek der blokerer SIGTERM: draebt, og knappen sluppet, FOER serveren gik (ca. 2 s)', serverVaek && lever() === 0 && slip >= 1 && ms < 4000, `server vaek=${serverVaek} efter ${ms} ms · lever=${lever()} · release-mouse=${slip}`); void kald; From 20ccd5fde826ba305b7db19265ead01cc8111999 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Mon, 2 Nov 2026 06:20:00 +0100 Subject: [PATCH 32/94] Efter R6 (begge GODKENDT): optageren startes ikke under nedlukning, to proever binder afslaget, praecis ordlyd MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - optag() tjekker nedlukningsflaget lige foer spawn - en optagestart der kom ind lige foer nedlukningen, kunne starte optageren (Opus R6-1, MAALT 4/4) - 15b: en NY laanebegaering afvises, og et opslag svarer stadig under nedlukningen (Opus' M1/M4 overlevede) - CHANGELOG: «refuses new calls that type, click or start a recording» (Astra R6); kommentaren tilskriver ikke laengere Astra en maaling, hun ikke lavede Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 2 +- mcp-server/godkend.js | 2 +- mcp-server/index.js | 5 ++++- test/skaerm-laan.mjs | 5 +++++ 4 files changed, 11 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 33d444e7..954c43c0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -17,7 +17,7 @@ and tell you in the chat, and its next loan asks you; no agent gets the screen w a question for those two minutes - on a clock that does not jump, and kept if the menu bar icon restarts (not across a restart of the Mac). A server that is closed mid-step (its client ends, a signal, or the client is gone) now stops what it is doing before it goes: it -starts nothing new that types, clicks or records, gives its writing helpers a moment, ends +refuses new calls that type, click or start a recording, gives its writing helpers a moment, ends one that hangs and lets go of a held drag - measured well inside the four seconds the MCP SDK's own client allows (a helper that is only looking can outlive it); the menu bar icon also says why a loan ended, so a take-back in the loan's last second is still a stop. A typo keeps the question. The audit log says whether diff --git a/mcp-server/godkend.js b/mcp-server/godkend.js index a3af8a84..6d3238c5 100644 --- a/mcp-server/godkend.js +++ b/mcp-server/godkend.js @@ -234,7 +234,7 @@ export async function laanSkaermen({ session, client, text, minutter, spoerg = t if (svaret) { // R3: efter ja'et kan ikonet sige, HVORFOR laanet slutter - foer det lukker forbindelsen. R4 (Astra, Opus): kun de tre // kendte grunde, og den staerkeste vinder (et stop overskrives ikke af et senere «expired»). - // R5 (Astra, MAALT: {toString:null} fik serveren til at gaa ned): kun en TEKST, og kun en af de tre egne noegler. + // R5 (Astra, LAEST - MAALT i 16h2: {toString:null} fik serveren til at gaa ned): kun en TEKST, og kun en af de tre egne noegler. if (m && m.nonce === nonce && typeof m.ended === 'string' && Object.hasOwn(SLUT_STYRKE, m.ended) && SLUT_STYRKE[m.ended] >= (SLUT_STYRKE[slutGrund] || 0)) slutGrund = m.ended; continue; diff --git a/mcp-server/index.js b/mcp-server/index.js index fc1cac60..188ce2fc 100644 --- a/mcp-server/index.js +++ b/mcp-server/index.js @@ -852,6 +852,8 @@ async function optag(args) { if (!hj) throw new HelperError('the helper binary was not found', 'helper-missing'); const a = ['record', '--out', sti, '--seconds', String(max)]; if (Number.isInteger(args.displayId)) a.push('--display-id', String(args.displayId)); + // R6 (Opus, MAALT 4/4): en optagestart, der kom ind lige FOER nedlukningen, kunne naa hertil efter den - optageren startes ikke. + if (nedlukningIGang()) throw new HelperError('the server is shutting down, so nothing new was started', 'shutting-down'); const barn = spawn(hj, a, { stdio: ['ignore', 'pipe', 'pipe'] }); let buf = '', sidste = null, startet, erStartet = false; const startLinje = new Promise(res => { startet = res; }); @@ -1506,7 +1508,8 @@ async function haandterKald(request) { // R45 (Opus B, MAALT P1): samme vaegt som porten bruger - en optagestart og et usloeret skaermbillede er skrivende. const skriver = tool && (tool.tier !== TIER.READ || (name === 'computer_record' && args.action === 'start') || (name === 'computer_screenshot' && args.redact === false)); - // R5 (Opus F1): under nedlukningen begynder intet nyt, der skriver - heller ikke en optagelse, og intet spoergsmaal stilles. + // R5 (Opus F1): under nedlukningen begynder intet NYT kald, der skriver - heller ikke en optagelse - og intet nyt kald stiller + // et spoergsmaal. (Et kald, der allerede var i gang, stoppes laengere inde: callHelper og optag tjekker flaget.) if (skriver && nedlukningIGang() && !(name === 'computer_request_screen' && args.action !== 'request')) { record({ tool: name, decision: 'denied', reason: 'the server is shutting down' }); return errorResult('Refused: the server is shutting down, so nothing new was started.'); diff --git a/test/skaerm-laan.mjs b/test/skaerm-laan.mjs index 081d9249..a71f31a3 100644 --- a/test/skaerm-laan.mjs +++ b/test/skaerm-laan.mjs @@ -767,6 +767,9 @@ for (const [navn, linjer, stop] of [['16h forkert nonce paa «taken-back», saa const type0 = HJ.handlingerNaaedeFrem().filter(k => k.argv[0] === 'type').length; let nySvar = null; X.kald('computer_type', { app: 'TextEdit', text: 'ny skrivning under nedlukningen' }).then(r => { nySvar = r; }, e => { nySvar = { fejl: true, tekst: String(e) }; }); // R4 (Astra P1) let nyOptag = null; X.kald('computer_record', { action: 'start' }).then(r => { nyOptag = r; }, e => { nyOptag = { fejl: true, tekst: String(e) }; }); // R5 (Opus F1) + // R6 (Opus M1/M4 overlevede): en NY laanebegaering afvises ogsaa - men et opslag svarer stadig. + let nyLaan = null; X.kald('computer_request_screen', { action: 'request', reason: 'another loan', minutes: 1 }).then(r => { nyLaan = r; }, e => { nyLaan = { fejl: true, tekst: String(e) }; }); + let opslag = null; X.kald('computer_apps', {}).then(r => { opslag = r; }, e => { opslag = { fejl: true, tekst: String(e) }; }); let serverVaek = false; for (let i = 0; i < 60 && !serverVaek; i++) { await vent(100); serverVaek = X.srv.exitCode !== null || X.srv.signalCode !== null; } const ms = Date.now() - t0; const slip = HJ.handlingerNaaedeFrem().filter(k => k.argv[0] === 'release-mouse').length - slip0; @@ -774,6 +777,8 @@ for (const [navn, linjer, stop] of [['16h forkert nonce paa «taken-back», saa check('15b under nedlukningen starter ingen NY skrivende hjaelper - den afvises med «shutting down»', HJ.handlingerNaaedeFrem().filter(k => k.argv[0] === 'type').length === type0 && /shutting down/.test(nySvar?.tekst || ''), `${HJ.handlingerNaaedeFrem().filter(k => k.argv[0] === 'type').length - type0} nye · svar: ${JSON.stringify(nySvar).slice(0, 160)}`); check('15b ...heller ingen NY optagelse - den afvises med «shutting down» (R5, Opus F1)', /shutting down/.test(nyOptag?.tekst || ''), JSON.stringify(nyOptag).slice(0, 160)); + check('15b ...heller ingen NY laanebegaering (R6, Opus M1)', /shutting down/.test(nyLaan?.tekst || ''), JSON.stringify(nyLaan).slice(0, 160)); + check('15b ...men et opslag svarer stadig under nedlukningen (R6, Opus M4)', opslag && !opslag.fejl, JSON.stringify(opslag).slice(0, 160)); check('15b et traek der blokerer SIGTERM: draebt, og knappen sluppet, FOER serveren gik (ca. 2 s)', serverVaek && lever() === 0 && slip >= 1 && ms < 4000, `server vaek=${serverVaek} efter ${ms} ms · lever=${lever()} · release-mouse=${slip}`); void kald; From 519474f1d342e95bc4c3ef088c45d9c63a6cd752 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Thu, 5 Nov 2026 01:25:56 +0100 Subject: [PATCH 33/94] Chrome-sider kan ses, og deres kodefelter svaertes: Chromes egen kontakt i stedet for Electrons MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Hjaelperen satte AXManualAccessibility paa Chrome ved hvert kald. Chrome har den ikke (System Events: -1728, «kan ikke hente»), saa Chrome-vinduer viste 0 elementer fra selve siderne: ingen tekst at finde, intet felt at skrive i (computer_type: focus-unknown), og intet kodefelt for sloeringen at se. Chromes egen kontakt er AXEnhancedUserInterface, den en skaermlaeser saetter. Den saettes nu i Chromium-browsere - kun dér, fordi den animerer vinduesflytninger i almindelige programmer. Maalt paa Chrome 156: - testside: 0 -> 6 elementer, kodefeltet som AXSecureTextField, secure: true - Chrome Web Store-konsollen i et rigtigt Chrome: 0 -> 3 traeffere - set-value i et tekstfelt: verified, laest tilbage; i kodefeltet: naegtet (secure-field) - sloeringen af et tungt dagligt Chrome med traeet taendt: 0,14-0,54 s Chrome bygger siden asynkront, 3-15 s efter kontakten (maalt fire gange). Imens siger find/focused det (tree_building), og sloeringen svaerter vinduer med en side-stoerrelse (>= 200x120) helt, saa laenge deres web-omraade er tomt. Web-omraadet ligger i dybde 8; foerste udgave soegte 6 og svaertede alt - fanget foer udrulning. Flader: README (tre steder), npm-README (udledt), security.html, llms.txt, CHANGELOG, og serverens instruktioner om overdragelsen fra en browser-udvidelse, som Chrome spaerrer paa Chrome Web Store og dens konsol. Proever: claims-offline 8b-8c, mutationsbevist (kontakten fjernet / sat paa alle programmer -> roed). Paastand 45 (npm-README uden drift): OK. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 14 +++ README.md | 53 ++++++---- docs/llms.txt | 3 +- docs/security.html | 2 +- .../Sources/cmcp-helper/Accessibility.swift | 99 ++++++++++++++++++- helper/Sources/cmcp-helper/main.swift | 9 +- mcp-server/README.md | 53 ++++++---- mcp-server/index.js | 20 +++- test/claims-offline.mjs | 25 +++++ 9 files changed, 228 insertions(+), 50 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 954c43c0..2498fbd1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,20 @@ was written down; where a claim has a test, the test is named. ## 0.4.0 (in progress) +**Chrome pages are visible, and their password fields are blacked out.** The switch +we set to make apps build their accessibility tree is Electron's; Chrome does not +have it (asked for it by name, macOS answers -1728). Chrome's own is the one a screen +reader sets, `AXEnhancedUserInterface`, and the helper now sets it in Chromium +browsers - only there, because in ordinary apps it animates window moves. Measured +on Chrome 156: a test page went from 0 page elements to 6, its password field found +as secure; writing into a page's text field verified; writing into the password +field refused (`secure-field`); the redaction scan of a heavy everyday Chrome took +0.2 s. Chrome builds the page in the background, 3 to 15 seconds after it is first +switched on: until then a reading answer says `tree_building`, and that Chrome window +is blacked out whole in screenshots. Only Google Chrome is measured. Tests: +`test/claims-offline.mjs` 8b-8c (mutation-proven: removing the switch, or setting it +on every app, turns them red). + **The screen without a question, if you want it.** Set `CMCP_SCREEN_ASK=0` and an agent that needs the screen borrows it with no question and no Touch ID - at once, or eight seconds after another agent's loan ends, so the one before has had time to stop diff --git a/README.md b/README.md index b4d63150..15b08891 100644 --- a/README.md +++ b/README.md @@ -33,15 +33,23 @@ in the hours you are not watching. fork with two windows open: **0 buttons before, 728 after**, same windows, same moment. `CMCP_INGEN_ELECTRON=1` turns it off if you would rather the app did not pay for keeping a tree it otherwise would not build. +- **Chrome pages are not a blind spot either.** Chrome ignores the Electron + switch - asked for it, it answers that the attribute does not exist - and + has its own: the one a screen reader sets. This server sets that one in + Chromium browsers. Measured 5 Nov on Chrome 156: a test page went from **0 + page elements to 6**, its password field among them and blacked out; the + redaction scan of a heavy everyday Chrome took 0.2 s. Honest limits: macOS only. It reads the accessibility tree, so an app that draws its own controls on a canvas and publishes nothing - some games, some -plotting tools - is still a blind spot. **A browser is a separate case:** the -switch above is an Electron API, and Chrome does not implement it. Measured on -Chrome: 29 buttons before and after, unchanged. You get the browser's own -window - tabs, toolbar, address bar - and the page inside it only when Chrome -has built that tree itself (measured both ways, see the limits below). For a -page, drive the browser with a browser tool. +plotting tools - is still a blind spot. **In a browser,** Chrome builds a page's +tree in the background the first time it is switched on, which took 3 to 15 +seconds in our measurements; until then a reading answer says `tree_building` +and that Chrome window is blacked out whole in screenshots. Only Google Chrome +is measured; Edge, Brave, Arc, Vivaldi and Opera get the same switch but are +not measured, and Safari and Firefox are not handled. When a browser tool is in +the session, let it do the work inside pages - this server takes over where it +is refused (see the limits below). No account, no API key, no model inside it. MIT. @@ -80,10 +88,12 @@ as a file. Native fields expose the role `AXSecureTextField`; fields in a web page expose role `AXTextField` with the *subrole* `AXSecureTextField`. Checking only the role would catch native fields and let every browser password box through - so both are checked. In a web page the field is only found when the -browser shows its page to the accessibility layer, and Chrome has done so on one and the same -Mac at one time and not at another (see the limits below). Where it does not, the field is not -painted over; what it shows is the browser's own dots, unless the page itself -shows the password in plain text. +browser shows its page to the accessibility layer. In Chrome this server switches +that on (above); while Chrome is still building the page - the first seconds +after it is switched on - the whole Chrome window is blacked out instead of +risking a field it cannot see yet. In a browser it does not switch on (Safari, +Firefox), the field is not painted over; what it shows is the browser's own +dots, unless the page itself shows the password in plain text. **2. The dangerous places ask first.** By default the agent works without interrupting you - that is what lets it run while you do something else - and @@ -488,16 +498,19 @@ sit unnoticed until it expires. That is a real limitation today, not a setting. - **Consent is not containment.** After you approve, the agent drives your real Mac - that is what you approved. If you need a boundary rather than a decision, run it in a VM. That is the honest answer, not a missing feature. -- **It cannot count on seeing inside web pages.** Measured 23 Sep on two Chromes - the - one in use and a clean Chrome for Testing: **zero** web areas in the - accessibility tree, no page text, only the browser's own buttons and address - bar. Chrome builds that tree for a real screen reader, not for the switch - Electron apps honour. Apps built on Electron - VS Code, Slack, Notion, the - IDE this was measured in - do expose their content: 4.000 nodes, 1.434 texts, - 267 buttons in one window. On 9 Oct the Chrome on the same Mac did show its - pages (861 nodes on one page). Why it changed is not measured - Chrome decides - for itself when to build that tree. Until that is measured and built on, treat - a web page as a browser tool's job and an app as this one's. +- **Web pages: Chrome only, and measured only on Chrome 156.** Measured 23 Sep on + two Chromes: **zero** web areas, only the browser's own buttons and address + bar - because the switch we set is Electron's, and Chrome does not have it + (asked for it by name, macOS answers -1728, "cannot get"). Chrome builds its + page tree for the switch a real screen reader sets, `AXEnhancedUserInterface`. + That is what changed on 9 Oct, when the same Chrome did show its pages: most + likely something else had set it (not measured). Since 5 Nov this server sets + it in Chromium browsers itself. Two consequences to know: the first read after + Chrome starts can come back without the page while Chrome builds it, and Chrome + blocks every extension on Chrome Web Store and its developer console ("The + extensions gallery cannot be scripted") - there a browser tool can navigate but + not act, and this server is the one that reads and presses. It finds the right + window by the browser tool's tab group, whose name is in the window title. - **Keystrokes do not land in a Chromium window that is not focused.** Measured the same day: the helper reported `typed: 21` and `took_screen: false`, and the text arrived nowhere. `computer_set_value` through the accessibility diff --git a/docs/llms.txt b/docs/llms.txt index 097ee5f3..c3f37e0e 100644 --- a/docs/llms.txt +++ b/docs/llms.txt @@ -31,7 +31,8 @@ for, because that machine also holds passwords, keys and production terminals. 1. Redaction before write. Secure text fields (role AXSecureTextField, and role AXTextField with subrole AXSecureTextField for web pages) plus whole - windows of listed password managers are painted opaque black on the bitmap + windows of listed password managers - and a Chrome window whose page is still + being built for accessibility - are painted opaque black on the bitmap in memory. The unredacted image is never written to disk. 2. Consent where it matters. Default mode `allow`: ordinary writes proceed and are logged. Password managers are refused in background mode (the diff --git a/docs/security.html b/docs/security.html index 5495143f..e80a0825 100644 --- a/docs/security.html +++ b/docs/security.html @@ -199,7 +199,7 @@

Gate 1 - redaction happens before the file exists

Had we written the file first and redacted after, there would be a window - short, but real - where an unredacted picture of your desktop sat on disk for any other process to read. A security property with a race in it is not a security property.

Two things get painted:

    -
  • Secure text fields. Native fields expose the role AXSecureTextField. Fields in a web page expose the role AXTextField with the subrole AXSecureTextField. Checking only the role catches native fields and lets every browser password box through - which is the case that actually matters. We check both.
    • +
  • Secure text fields. Native fields expose the role AXSecureTextField. Fields in a web page expose the role AXTextField with the subrole AXSecureTextField. Checking only the role catches native fields and lets every browser password box through - which is the case that actually matters. We check both. A field in a web page is only visible once the browser shows its page to the accessibility layer: in Chrome this server switches that on (the switch a screen reader uses), and while Chrome is still building the page - 3 to 15 seconds after it is first switched on, measured on Chrome 156 - the whole Chrome window is painted over instead.
  • Whole windows of listed apps. Keychain Access, 1Password, Bitwarden, LastPass, Dashlane, Apple Passwords. We do not walk into those windows to decide what to hide; descending into a vault to work out what is secret is the mistake we are avoiding.

The rectangles are painted solid black, not blurred or pixelated. A good enough model can read through pixelation. It cannot read through black.

diff --git a/helper/Sources/cmcp-helper/Accessibility.swift b/helper/Sources/cmcp-helper/Accessibility.swift index 948094f5..b58c3ec0 100644 --- a/helper/Sources/cmcp-helper/Accessibility.swift +++ b/helper/Sources/cmcp-helper/Accessibility.swift @@ -57,17 +57,84 @@ enum AX { // Standarden er uaendret: traeet taendes. static let taendTraeSlaaetFra = ProcessInfo.processInfo.environment["CMCP_INGEN_ELECTRON"] == "1" + /// ⛔ MAALT 4/11-2026: Google Chrome KENDER IKKE `AXManualAccessibility`. + /// System Events: «Kan ikke hente attribute "AXManualAccessibility" of + /// application process "Google Chrome"» (-1728). Kontakten ovenfor er en + /// Electron-opfindelse; vi satte den paa Chrome ved hvert kald, og Chrome + /// ignorerede den. Resultatet var et vindue uden web-omraade: 185 elementer + /// laest i to Chrome-vinduer - faner, adresselinje, knapper - og NUL fra selve + /// siderne. Saa kunne vi hverken taste i en side (computer_type: focus-unknown) + /// eller se et adgangskodefelt i den, og det sidste betyder at sloeringen + /// af kodeord i Chrome-sider ikke kunne holde, hvad forsiden lover. + /// + /// Chromes egen kontakt er `AXEnhancedUserInterface` - den VoiceOver saetter. + /// Maalt paa en engangs-profil af Chrome 156 med en testside: + /// foer: computer_find «CMCPAXTEST» -> 0 traeffere (titlen fandtes, siden ikke) + /// efter: 6 - overskrift, link, tekstfelt MED sin vaerdi, og kodefeltet som + /// AXSecureTextField, secure: true + /// Og kun dér: den anden Chrome-proces paa maskinen stod uroert paa false. + /// + /// Den saettes KUN paa Chromium-browsere. Paa almindelige AppKit-programmer har + /// den en kendt bivirkning (vinduesflytninger animeres), og dem ser vi i + /// forvejen uden den. Kun Google Chrome er maalt; de andre er samme motor. + static let chromiumBrowsere: Set = [ + "com.google.Chrome", "com.google.Chrome.beta", "com.google.Chrome.dev", "com.google.Chrome.canary", + "org.chromium.Chromium", + "com.brave.Browser", "com.brave.Browser.beta", "com.brave.Browser.nightly", + "com.microsoft.edgemac", "com.microsoft.edgemac.Beta", "com.microsoft.edgemac.Dev", "com.microsoft.edgemac.Canary", + "com.vivaldi.Vivaldi", "company.thebrowser.Browser", "com.operasoftware.Opera", + ] + + /// ⛔ MAALT 4/11: Chrome bygger web-traeet ASYNKRONT efter kontakten. Det kald der + /// taendte den, saa 0 (0,15 s); traeet kom 3-15 s senere (maalt fire gange, vinduet paa + /// en slukket skaerm). En agent der faar «0» i det foerste kald, konkluderer at siden + /// er tom. Svaret skal derfor sige det, naar netop DETTE kald taendte kontakten. + static var chromeTaendtNu = false + static func taendTrae(_ pid: pid_t) { guard !taendTraeSlaaetFra else { return } guard !traeTaendt.contains(pid) else { return } traeTaendt.insert(pid) - AXUIElementSetAttributeValue( - AXUIElementCreateApplication(pid), - "AXManualAccessibility" as CFString, - kCFBooleanTrue - ) + let program = AXUIElementCreateApplication(pid) + AXUIElementSetAttributeValue(program, "AXManualAccessibility" as CFString, kCFBooleanTrue) + if let id = NSRunningApplication(processIdentifier: pid)?.bundleIdentifier, chromiumBrowsere.contains(id) { + var nu: CFTypeRef? + let varTaendt = AXUIElementCopyAttributeValue(program, "AXEnhancedUserInterface" as CFString, &nu) == .success + && (nu as? Bool) == true + if !varTaendt { + AXUIElementSetAttributeValue(program, "AXEnhancedUserInterface" as CFString, kCFBooleanTrue) + chromeTaendtNu = true + } + } + } + + /// Har dette Chromium-vindue et web-omraade MED indhold? Maalt 4/11: med traeet + /// slukket har vinduet ingen AXWebArea (185 elementer, 0 web); mens det bygges, kan + /// omraadet staa tomt. Begge dele betyder at sloeringen ikke kan se et kodefelt. + /// Bredde-foerst og stopper ved foerste fund. ⛔ MAALT 4/11: omraadet ligger i DYBDE 8 + /// (inspect --format json, Chrome 156) - foerste udgave gik 6 niveauer ned, fandt det aldrig og + /// svaertede derfor ALLE Chrome-vinduer, ogsaa dem med bygget indhold. 12 giver luft. + static func harWebIndhold(_ win: AXUIElement) -> Bool { + var lag = [win] + for _ in 0..<12 { + var naeste: [AXUIElement] = [] + for el in lag { + if string(el, kAXRoleAttribute as String) == "AXWebArea" { + if !children(el).isEmpty { return true } + continue + } + naeste.append(contentsOf: children(el)) + } + if naeste.isEmpty { return false } + lag = naeste + } + return false } + /// Den ene saetning alle laesende svar bruger, naar svaret kan vaere tomt alene fordi + /// Chrome stadig bygger sit trae. + static let chromeByggerNote = "Chrome's page content was switched on for accessibility by this call, and Chrome builds it in the background (measured 3 to 15 seconds). If the page itself is missing from this answer, read again in a few seconds before concluding it is empty." + // MARK: - Lavniveau /// ⛔ MAALT 23/9: med en svarfrist paa programmet gik Finder fra 39,5 sek @@ -612,6 +679,15 @@ enum AX { let bid = (app.bundleIdentifier ?? "").lowercased() let isDenied = deny.contains(where: { $0.lowercased() == bid }) AX.taendTrae(app.processIdentifier) + // ⛔ MAALT 4/11: Chrome bygger sit web-trae 3-15 s EFTER kontakten. I de + // sekunder fandt sloeringen 0 sikre felter paa en side med et synligt + // kodefelt. Et Chromium-vindue hvis web-indhold ikke er bygget endnu, kan vi + // derfor ikke staa inde for - det svaertes helt, som afviste programmer. + // (Med CMCP_INGEN_ELECTRON=1 er traeet slaaet fra med vilje; saa gaelder den + // dokumenterede pris, ikke denne faldbag.) + let erChromium = !AX.taendTraeSlaaetFra + && AX.chromiumBrowsere.contains(app.bundleIdentifier ?? "") + var chromeNoteSat = false let axApp = AXUIElementCreateApplication(app.processIdentifier) // Et enkelt haengende opslag maa ikke kunne spise hele budgettet. AXUIElementSetMessagingTimeout(axApp, 2.0) @@ -675,6 +751,19 @@ enum AX { sloeringStoppede.append(app.localizedName ?? bid) continue } + // ⛔ MAALT 4/11: Chrome har ogsaa titelloese hjaelpe-vinduer (fanelinje og + // vaerktoejslinje som strimler paa 41-47 punkters hoejde, og et paa 13 i + // bredden). De har aldrig et web-omraade, og foerste udgave svaertede dem i + // HVERT billede. Reglen gaelder kun vinduer der kan rumme en side. + if erChromium, let rf = frame(win), rf.w >= 200, rf.h >= 120, !AX.harWebIndhold(win) { + let hele = frame(win).map { [$0] } ?? cgRammer(pid: app.processIdentifier) + out.append(contentsOf: hele.isEmpty ? [indenfor ?? heleSkaermen()] : hele) + if !chromeNoteSat { + sloeringStoppede.append((app.localizedName ?? bid) + " (its page content was still being built, so the window was blacked out whole)") + chromeNoteSat = true + } + continue + } if isDenied { // Hele vinduet ud. Vi gaar ikke ind i det - at gaa ind i en // adgangskode-boks for at finde ud af hvad der skal sloeres, diff --git a/helper/Sources/cmcp-helper/main.swift b/helper/Sources/cmcp-helper/main.swift index 70b6f38f..5429c904 100644 --- a/helper/Sources/cmcp-helper/main.swift +++ b/helper/Sources/cmcp-helper/main.swift @@ -504,6 +504,11 @@ case "find": fundSvar["stopped_early"] = true fundSvar["note"] = "The search stopped after \(Int(AX.tidsgraense)) seconds - this app answers slowly, so these are the matches in PART of it, not all. Narrow it with role, subrole, title or a lower depth." } + // ⛔ MAALT 4/11: kaldet der taendte Chromes web-trae, saa 0 - traeet kom 5-15 s senere. + if hits.isEmpty && AX.chromeTaendtNu { + fundSvar["tree_building"] = true + fundSvar["note"] = AX.chromeByggerNote + } Out.ok(fundSvar) case "set-value": @@ -806,7 +811,9 @@ case "focused": Out.ok(["focused": true, "element": f.dict]) } else { Out.ok(["focused": false, - "hint": "no element has keyboard focus - click or press into the field first"]) + "hint": AX.chromeTaendtNu + ? "no element has keyboard focus yet. " + AX.chromeByggerNote + : "no element has keyboard focus - click or press into the field first"]) } case "wait-for": diff --git a/mcp-server/README.md b/mcp-server/README.md index 82b00e7f..e37ee1e3 100644 --- a/mcp-server/README.md +++ b/mcp-server/README.md @@ -31,15 +31,23 @@ in the hours you are not watching. fork with two windows open: **0 buttons before, 728 after**, same windows, same moment. `CMCP_INGEN_ELECTRON=1` turns it off if you would rather the app did not pay for keeping a tree it otherwise would not build. +- **Chrome pages are not a blind spot either.** Chrome ignores the Electron + switch - asked for it, it answers that the attribute does not exist - and + has its own: the one a screen reader sets. This server sets that one in + Chromium browsers. Measured 5 Nov on Chrome 156: a test page went from **0 + page elements to 6**, its password field among them and blacked out; the + redaction scan of a heavy everyday Chrome took 0.2 s. Honest limits: macOS only. It reads the accessibility tree, so an app that draws its own controls on a canvas and publishes nothing - some games, some -plotting tools - is still a blind spot. **A browser is a separate case:** the -switch above is an Electron API, and Chrome does not implement it. Measured on -Chrome: 29 buttons before and after, unchanged. You get the browser's own -window - tabs, toolbar, address bar - and the page inside it only when Chrome -has built that tree itself (measured both ways, see the limits below). For a -page, drive the browser with a browser tool. +plotting tools - is still a blind spot. **In a browser,** Chrome builds a page's +tree in the background the first time it is switched on, which took 3 to 15 +seconds in our measurements; until then a reading answer says `tree_building` +and that Chrome window is blacked out whole in screenshots. Only Google Chrome +is measured; Edge, Brave, Arc, Vivaldi and Opera get the same switch but are +not measured, and Safari and Firefox are not handled. When a browser tool is in +the session, let it do the work inside pages - this server takes over where it +is refused (see the limits below). No account, no API key, no model inside it. MIT. @@ -78,10 +86,12 @@ as a file. Native fields expose the role `AXSecureTextField`; fields in a web page expose role `AXTextField` with the *subrole* `AXSecureTextField`. Checking only the role would catch native fields and let every browser password box through - so both are checked. In a web page the field is only found when the -browser shows its page to the accessibility layer, and Chrome has done so on one and the same -Mac at one time and not at another (see the limits below). Where it does not, the field is not -painted over; what it shows is the browser's own dots, unless the page itself -shows the password in plain text. +browser shows its page to the accessibility layer. In Chrome this server switches +that on (above); while Chrome is still building the page - the first seconds +after it is switched on - the whole Chrome window is blacked out instead of +risking a field it cannot see yet. In a browser it does not switch on (Safari, +Firefox), the field is not painted over; what it shows is the browser's own +dots, unless the page itself shows the password in plain text. **2. The dangerous places ask first.** By default the agent works without interrupting you - that is what lets it run while you do something else - and @@ -486,16 +496,19 @@ sit unnoticed until it expires. That is a real limitation today, not a setting. - **Consent is not containment.** After you approve, the agent drives your real Mac - that is what you approved. If you need a boundary rather than a decision, run it in a VM. That is the honest answer, not a missing feature. -- **It cannot count on seeing inside web pages.** Measured 23 Sep on two Chromes - the - one in use and a clean Chrome for Testing: **zero** web areas in the - accessibility tree, no page text, only the browser's own buttons and address - bar. Chrome builds that tree for a real screen reader, not for the switch - Electron apps honour. Apps built on Electron - VS Code, Slack, Notion, the - IDE this was measured in - do expose their content: 4.000 nodes, 1.434 texts, - 267 buttons in one window. On 9 Oct the Chrome on the same Mac did show its - pages (861 nodes on one page). Why it changed is not measured - Chrome decides - for itself when to build that tree. Until that is measured and built on, treat - a web page as a browser tool's job and an app as this one's. +- **Web pages: Chrome only, and measured only on Chrome 156.** Measured 23 Sep on + two Chromes: **zero** web areas, only the browser's own buttons and address + bar - because the switch we set is Electron's, and Chrome does not have it + (asked for it by name, macOS answers -1728, "cannot get"). Chrome builds its + page tree for the switch a real screen reader sets, `AXEnhancedUserInterface`. + That is what changed on 9 Oct, when the same Chrome did show its pages: most + likely something else had set it (not measured). Since 5 Nov this server sets + it in Chromium browsers itself. Two consequences to know: the first read after + Chrome starts can come back without the page while Chrome builds it, and Chrome + blocks every extension on Chrome Web Store and its developer console ("The + extensions gallery cannot be scripted") - there a browser tool can navigate but + not act, and this server is the one that reads and presses. It finds the right + window by the browser tool's tab group, whose name is in the window title. - **Keystrokes do not land in a Chromium window that is not focused.** Measured the same day: the helper reported `typed: 21` and `took_screen: false`, and the text arrived nowhere. `computer_set_value` through the accessibility diff --git a/mcp-server/index.js b/mcp-server/index.js index 188ce2fc..b70b74b4 100644 --- a/mcp-server/index.js +++ b/mcp-server/index.js @@ -261,8 +261,24 @@ the one wrong move; never work around a refusal. Reading: \`computer_inspect\` answers as text by default. If it says INCOMPLETE or [cut: ...], the answer is PART of the tree - narrow it with \`computer_find\` -rather than trusting what came back. It does not see inside web pages; that is -what a browser tool is for. +rather than trusting what came back. + +Web pages in Chrome (and other Chromium browsers): this server sees inside them +too - headings, links, text fields with their values, and password fields as +secure, so they are blacked out in screenshots (measured 5 Nov on Chrome 156: +a test page went from 0 page elements to 6, its password field among them as +secure; the scan of a heavy everyday Chrome took 0.2 s). Chrome builds that +content in the background the first time it is asked, which takes 3 to 15 +seconds; an answer that came back without the page says so (\`tree_building\`), +and until it is built, that Chrome window is blacked out whole in screenshots. +Read again before you conclude a page is empty. +When a browser tool is also in this session (Browser MCP's browser_*), let it do +the work inside pages, and take over where it is refused: Chrome blocks EVERY +extension on Chrome Web Store and its developer console ("The extensions gallery +cannot be scripted"). The browser tool can still navigate there and list its +tabs. Find that window by its tab group: the group's name is in the window title +("... - part of the Claude 2 group - ..."), and browser_list_tabs reports it as +"session". That name is the link between the two tools. Everything is written to an append-only audit log with a rolling chain.`; diff --git a/test/claims-offline.mjs b/test/claims-offline.mjs index b73bcb30..d90e33f7 100644 --- a/test/claims-offline.mjs +++ b/test/claims-offline.mjs @@ -129,6 +129,31 @@ check('den taendes kun én gang pr. proces', /traeTaendt\.contains\(pid\)/.test(fn) && /traeTaendt\.insert\(pid\)/.test(fn), 'det koster i appen selv at holde traeet i live'); +// 8b. ⛔ CHROME-LEDNINGEN (maalt 4/11-2026): Google Chrome kender IKKE AXManualAccessibility +// (System Events: -1728, «kan ikke hente»). Dens kontakt er AXEnhancedUserInterface. Uden den +// saa vi 0 elementer fra selve siderne i to Chrome-vinduer, kunne ikke taste (focus-unknown) og +// kunne ikke finde et kodefelt at sloere. Paa en engangs-profil: 0 -> 6 elementer, kodefeltet +// som AXSecureTextField. Og den maa KUN saettes paa Chromium-browsere - paa AppKit-programmer +// animerer den vinduesflytninger, og dem ser vi i forvejen. +const tStart = sw.indexOf('static func taendTrae'); +const hel = sw.slice(tStart, sw.indexOf('\n }\n', tStart) + 6); +const foerTjek = hel.slice(0, hel.indexOf('chromiumBrowsere.contains(id)')); +check('Chrome faar sin egen kontakt, AXEnhancedUserInterface', + /AXUIElementSetAttributeValue\(program, "AXEnhancedUserInterface" as CFString, kCFBooleanTrue\)/.test(hel), + 'uden den er Chrome-siderne tomme for os'); +check('... men kun bag Chromium-tjekket, aldrig paa alle programmer', + hel.includes('chromiumBrowsere.contains(id)') && !/AXEnhancedUserInterface/.test(foerTjek), + 'saat paa alle programmer animerer den vinduer i AppKit-programmer'); +// 8c. Traeet bygges ASYNKRONT (maalt 3-15 s, fire gange). Det kald der taendte det, maa ikke svare et +// stumt «0» - saa konkluderer agenten at siden er tom. +const mainSw = readFileSync(new URL('../helper/Sources/cmcp-helper/main.swift', import.meta.url), 'utf8'); +check('find siger det, naar kaldet selv lige taendte Chrome-traeet', + /hits\.isEmpty && AX\.chromeTaendtNu[^]{0,120}tree_building/.test(mainSw), + 'et foerste «0» laeses som en tom side'); +check('focused siger det ogsaa', /AX\.chromeTaendtNu\s*\?[^]{0,80}chromeByggerNote/.test(mainSw), + 'computer_type afviser med focus-unknown uden at sige hvorfor'); +check('Google Chrome staar paa listen', /"com\.google\.Chrome"/.test(sw), 'den eneste browser der er maalt'); + // ...og den kan slaas fra. Uden det er «0 foer, 728 efter» et tal ingen // udefra kan efterproeve, for kontakten kan ikke slaas fra igen paa en // proces der allerede er taendt. Med flaget er foer-tallet to kommandoer. From 206001f7576482d42d98a26bbb3e1c48a69d6780 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Thu, 5 Nov 2026 01:26:32 +0100 Subject: [PATCH 34/94] To proever binder nattens to fejl i Chrome-sloeringen 8d: harWebIndhold skal soege dybere end web-omraadet (maalt i dybde 8). Foerste udgave soegte 6 og svaertede alle Chrome-vinduer i hvert billede. 8e: kun vinduer med side-stoerrelse (>= 200x120) svaertes for et ubygget trae; Chromes titelloese strimler (fanelinje, vaerktoejslinje) har aldrig et web-omraade. Begge mutationsbeviste: dybde 12 -> 6 og graensen fjernet goer hver sin roed. Co-Authored-By: Claude Opus 5.5 --- test/claims-offline.mjs | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/test/claims-offline.mjs b/test/claims-offline.mjs index d90e33f7..7672ca0d 100644 --- a/test/claims-offline.mjs +++ b/test/claims-offline.mjs @@ -152,6 +152,15 @@ check('find siger det, naar kaldet selv lige taendte Chrome-traeet', 'et foerste «0» laeses som en tom side'); check('focused siger det ogsaa', /AX\.chromeTaendtNu\s*\?[^]{0,80}chromeByggerNote/.test(mainSw), 'computer_type afviser med focus-unknown uden at sige hvorfor'); +// 8d. ⛔ MAALT 5/11: web-omraadet ligger i DYBDE 8. Foerste udgave af harWebIndhold soegte 6 +// niveauer, fandt det aldrig, og svaertede derfor ALLE Chrome-vinduer i hvert billede. +const hw = sw.slice(sw.indexOf('static func harWebIndhold'), sw.indexOf('static func harWebIndhold') + 900); +const niv = Number((hw.match(/for _ in 0\.\.<(\d+)/) || [])[1] || 0); +check('harWebIndhold soeger dybere end web-omraadet (dybde 8)', niv >= 9, `soeger ${niv} niveauer`); +// 8e. Chromes titelloese hjaelpe-vinduer (41-47 pkt hoeje strimler) har aldrig et web-omraade. +check('kun vinduer med side-stoerrelse svaertes for et ubygget trae', + /rf\.w >= 200, rf\.h >= 120, !AX\.harWebIndhold\(win\)/.test(sw), + 'ellers svaertes fanelinje og vaerktoejslinje i hvert billede'); check('Google Chrome staar paa listen', /"com\.google\.Chrome"/.test(sw), 'den eneste browser der er maalt'); // ...og den kan slaas fra. Uden det er «0 foer, 728 efter» et tal ingen From 7dea134f4b9211f8ac4caf15eae7bbc2a2cf287d Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Thu, 5 Nov 2026 01:55:32 +0100 Subject: [PATCH 35/94] Efter Opus-review (IKKE GODKENDT): porten lukket paa fire huller, og proeverne maaler adfaerd MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reviewet fandt at sloeringen af Chrome-sider kunne slippe et kodefelt igennem, og at claims-offline 8b-8e kun tjekkede at strenge stod der (7 af 8 mutationer forblev groenne). Rettet og maalt: - F1: ALLE web-omraader paa topniveau skal have indhold - et bygget sidepanel kunne foer lade en ubygget side slippe gennem porten. - F2: en ulaeselig ramme eller underrolle springer ikke laengere porten over. - F5 (MAALT ROED foer rettelsen): et kodefelt under 45 indlejrede grupper laa dybere end gennemgangen (40) og blev hverken fundet eller fik vinduet svaertet - 0 rektangler. Rammer gennemgangen af et Chrome-vindue loftet eller et opslag tiden, svaertes hele vinduet. Gustavs rigtige sider gaar til dybde 16, og hans Chrome svaertes ikke af det (0,19 s, intet sort). - F7: Chrome for Testing og Chromes kanaler genkendes paa praefiks; PWA-skaller og hjaelpeprocessen holdes ude og staar som ikke daekket. - Chromes egne bobler (ikke AXStandardWindow) svaertes ikke laengere i hvert billede. - tree_building afspejler nu tilstanden (et Chrome-vindue hvis side ikke kan laeses), ikke kun det ene kald der vendte kontakten - adfaerdsproeven fandt det stumme 0. Proever der maaler adfaerd mod en rigtig Chrome: - test/chrome-side-live.mjs: 6/6, to gange; fire mutanter (ingen svaertning, web-omraadet altid «bygget», Chrome aldrig genkendt, tree_building slaaet fra) goer hver sin roed. - test/chrome-dyb-side-live.mjs: roed foer F5, groen efter. - claims-offline: den sendte binaer skal baere AXEnhancedUserInterface (LOEFTER). Flader: README (prisen: fuld tilgaengeligheds-tilstand i Chrome til den lukkes, mulig vinduesanimation, adgangskode-programmer i Chrome kan laeses som tekst, flaget slukker ogsaa Chrome; kendte huller: tvaers-af-domaene-rammer, et login-trin foer traeet er opdateret), CHANGELOG, instruktionerne, forsiden, security.html, npm-README udledt. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 26 +++-- README.md | 62 ++++++++---- docs/index.html | 2 +- docs/security.html | 2 +- .../Sources/cmcp-helper/Accessibility.swift | 79 ++++++++++++--- helper/Sources/cmcp-helper/main.swift | 6 +- mcp-server/README.md | 62 ++++++++---- mcp-server/index.js | 18 ++-- test/chrome-dyb-side-live.mjs | 79 +++++++++++++++ test/chrome-side-live.mjs | 96 +++++++++++++++++++ test/claims-offline.mjs | 12 ++- 11 files changed, 362 insertions(+), 82 deletions(-) create mode 100644 test/chrome-dyb-side-live.mjs create mode 100644 test/chrome-side-live.mjs diff --git a/CHANGELOG.md b/CHANGELOG.md index 2498fbd1..463a93b2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,16 +8,22 @@ was written down; where a claim has a test, the test is named. **Chrome pages are visible, and their password fields are blacked out.** The switch we set to make apps build their accessibility tree is Electron's; Chrome does not have it (asked for it by name, macOS answers -1728). Chrome's own is the one a screen -reader sets, `AXEnhancedUserInterface`, and the helper now sets it in Chromium -browsers - only there, because in ordinary apps it animates window moves. Measured -on Chrome 156: a test page went from 0 page elements to 6, its password field found -as secure; writing into a page's text field verified; writing into the password -field refused (`secure-field`); the redaction scan of a heavy everyday Chrome took -0.2 s. Chrome builds the page in the background, 3 to 15 seconds after it is first -switched on: until then a reading answer says `tree_building`, and that Chrome window -is blacked out whole in screenshots. Only Google Chrome is measured. Tests: -`test/claims-offline.mjs` 8b-8c (mutation-proven: removing the switch, or setting it -on every app, turns them red). +reader sets, `AXEnhancedUserInterface`, and the helper now sets it in Google Chrome +(every channel, Chrome for Testing included) and in Edge, Brave, Arc, Vivaldi, Opera +and Chromium - not in other apps, where it animates window moves. Measured on Chrome +156: a test page went from 0 page elements to 6, its password field found as secure; +writing into a page's text field verified; writing into the password field refused +(`secure-field`); the redaction scan of a heavy everyday Chrome took 0.14 to 0.54 s. +Chrome builds the page in the background, 3 to 15 seconds after it is first switched +on. While a Chrome window's page is not readable - still building, or empty - a search +that finds nothing says `tree_building`, and screenshots black that window out whole. +Costs and changes, written in the README: Chrome keeps full accessibility mode until +it quits; its windows may animate when moved (not measured); password managers that +run inside Chrome can be read as text; `CMCP_INGEN_ELECTRON=1` leaves Chrome off too. +Only Google Chrome is measured. Tests: `test/chrome-side-live.mjs` (against a real +Chrome; four mutants - no blackout, web area always "built", Chrome never recognised, +`tree_building` off - each turn it red) and `test/claims-offline.mjs` 8b-8e (that the +code and the shipped binary carry the switch). **The screen without a question, if you want it.** Set `CMCP_SCREEN_ASK=0` and an agent that needs the screen borrows it with no question and no Touch ID - at once, or diff --git a/README.md b/README.md index 15b08891..814dde32 100644 --- a/README.md +++ b/README.md @@ -32,24 +32,30 @@ in the hours you are not watching. This one switches the tree on itself before it looks. Measured on a VS Code fork with two windows open: **0 buttons before, 728 after**, same windows, same moment. `CMCP_INGEN_ELECTRON=1` turns it off if you would rather the app - did not pay for keeping a tree it otherwise would not build. + did not pay for keeping a tree it otherwise would not build - and it turns off + Chrome's switch below too, so Chrome pages are then neither readable nor have + their password fields blacked out. - **Chrome pages are not a blind spot either.** Chrome ignores the Electron switch - asked for it, it answers that the attribute does not exist - and has its own: the one a screen reader sets. This server sets that one in - Chromium browsers. Measured 5 Nov on Chrome 156: a test page went from **0 - page elements to 6**, its password field among them and blacked out; the - redaction scan of a heavy everyday Chrome took 0.2 s. + Google Chrome (every channel, Chrome for Testing included) and in Edge, + Brave, Arc, Vivaldi, Opera and Chromium. Measured 5 Nov on Chrome 156: a + test page went from **0 page elements to 6**, its password field among them + and blacked out; the redaction scan of a heavy everyday Chrome took 0.14 to + 0.54 s. `test/chrome-side-live.mjs` proves it against a real Chrome. Honest limits: macOS only. It reads the accessibility tree, so an app that draws its own controls on a canvas and publishes nothing - some games, some plotting tools - is still a blind spot. **In a browser,** Chrome builds a page's tree in the background the first time it is switched on, which took 3 to 15 -seconds in our measurements; until then a reading answer says `tree_building` -and that Chrome window is blacked out whole in screenshots. Only Google Chrome -is measured; Edge, Brave, Arc, Vivaldi and Opera get the same switch but are -not measured, and Safari and Firefox are not handled. When a browser tool is in -the session, let it do the work inside pages - this server takes over where it -is refused (see the limits below). +seconds in our measurements; until then a search that finds nothing says +`tree_building`, and that Chrome window is blacked out whole in screenshots +(the screenshot only says how many regions were blacked out, not why). Only +Google Chrome is measured. Other Chromium browsers than the ones named above - +Chrome app windows (PWAs) included - are not switched on and not covered, and +Safari and Firefox are not handled. When a browser tool is in the session, let +it do the work inside pages - this server takes over where it is refused (see +the limits below). No account, no API key, no model inside it. MIT. @@ -89,11 +95,15 @@ page expose role `AXTextField` with the *subrole* `AXSecureTextField`. Checking only the role would catch native fields and let every browser password box through - so both are checked. In a web page the field is only found when the browser shows its page to the accessibility layer. In Chrome this server switches -that on (above); while Chrome is still building the page - the first seconds -after it is switched on - the whole Chrome window is blacked out instead of -risking a field it cannot see yet. In a browser it does not switch on (Safari, -Firefox), the field is not painted over; what it shows is the browser's own -dots, unless the page itself shows the password in plain text. +that on (above); while a Chrome window's page is not readable yet - the first +seconds after it is switched on, or an empty page - the whole window is blacked +out instead of risking a field it cannot see. Known gaps, not measured: a login +form inside a cross-site frame, or a second step that appears before Chrome has +updated its tree, can be on screen a moment before the field is in the tree. In +a browser it does not switch on (Safari, Firefox, other Chromium browsers, and +any browser with `CMCP_INGEN_ELECTRON=1`), the field is not painted over; what +it shows is the browser's own dots, unless the page shows the password in plain +text. **2. The dangerous places ask first.** By default the agent works without interrupting you - that is what lets it run while you do something else - and @@ -505,12 +515,22 @@ sit unnoticed until it expires. That is a real limitation today, not a setting. page tree for the switch a real screen reader sets, `AXEnhancedUserInterface`. That is what changed on 9 Oct, when the same Chrome did show its pages: most likely something else had set it (not measured). Since 5 Nov this server sets - it in Chromium browsers itself. Two consequences to know: the first read after - Chrome starts can come back without the page while Chrome builds it, and Chrome - blocks every extension on Chrome Web Store and its developer console ("The - extensions gallery cannot be scripted") - there a browser tool can navigate but - not act, and this server is the one that reads and presses. It finds the right - window by the browser tool's tab group, whose name is in the window title. + it in the browsers named above itself. What that costs and changes, so you can + decide: Chrome keeps its full accessibility mode for every window and profile + until it quits, which costs memory and CPU in Chrome (not measured separately - + Chrome's own memory swung ±500 MB in 30 s); Chrome's windows may animate when + they are moved (the known side effect of this switch, not measured on Chrome); + any call that looks at Chrome switches it on, not only screenshots; and + password managers that run INSIDE Chrome - an extension's popup, a web vault, + Chrome's own password page - can now be read as text by `computer_find` and + `computer_inspect`, where before only their pixels were in a screenshot. Native + password managers are blacked out whole as before; these are not on that list. + `CMCP_INGEN_ELECTRON=1` leaves Chrome's switch off too. And Chrome blocks every + extension on Chrome Web Store and its developer console ("The extensions gallery + cannot be scripted") - there a browser tool can navigate but not act, and this + server can read the page (measured on the developer console). An agent finds + the right window by the browser tool's tab group: the window title contains the + group's name, in Chrome's own interface language. - **Keystrokes do not land in a Chromium window that is not focused.** Measured the same day: the helper reported `typed: 21` and `took_screen: false`, and the text arrived nowhere. `computer_set_value` through the accessibility diff --git a/docs/index.html b/docs/index.html index bf272930..ffa3910c 100644 --- a/docs/index.html +++ b/docs/index.html @@ -767,7 +767,7 @@

The three gates

Honest limits

  • macOS only. No Windows or Linux build is planned.
    • -
  • Not the inside of a web page. For that, use a browser tool.
    • +
  • Web pages in Chrome, not in Safari or Firefox. Chrome's page is readable once Chrome has built it (3 to 15 seconds the first time); use a browser tool for the page when you have one.
  • Apps that paint everything on a canvas are a blind spot.
  • Only fields macOS marks as secure are blacked out. A password in a plain text file is not.
  • Consent is not a sandbox. If you need containment, run it in a VM.
    • diff --git a/docs/security.html b/docs/security.html index e80a0825..718917e7 100644 --- a/docs/security.html +++ b/docs/security.html @@ -199,7 +199,7 @@

    Gate 1 - redaction happens before the file exists

    Had we written the file first and redacted after, there would be a window - short, but real - where an unredacted picture of your desktop sat on disk for any other process to read. A security property with a race in it is not a security property.

    Two things get painted:

      -
    • Secure text fields. Native fields expose the role AXSecureTextField. Fields in a web page expose the role AXTextField with the subrole AXSecureTextField. Checking only the role catches native fields and lets every browser password box through - which is the case that actually matters. We check both. A field in a web page is only visible once the browser shows its page to the accessibility layer: in Chrome this server switches that on (the switch a screen reader uses), and while Chrome is still building the page - 3 to 15 seconds after it is first switched on, measured on Chrome 156 - the whole Chrome window is painted over instead.
      • +
    • Secure text fields. Native fields expose the role AXSecureTextField. Fields in a web page expose the role AXTextField with the subrole AXSecureTextField. Checking only the role catches native fields and lets every browser password box through - which is the case that actually matters. We check both. A field in a web page is only visible once the browser shows its page to the accessibility layer: in Chrome this server switches that on (the switch a screen reader uses), and while a Chrome window's page is not readable yet - still being built, 3 to 15 seconds after it is first switched on, measured on Chrome 156, or empty - the whole window is painted over instead. Not covered: Safari, Firefox, Chromium browsers we do not name, Chrome app windows, and any browser when CMCP_INGEN_ELECTRON=1 is set. Known gaps, not measured: a field in a cross-site frame, or a login step that appears before Chrome has updated its tree. Password managers that run inside Chrome are readable as text by the reading tools; native ones are blacked out whole.
    • Whole windows of listed apps. Keychain Access, 1Password, Bitwarden, LastPass, Dashlane, Apple Passwords. We do not walk into those windows to decide what to hide; descending into a vault to work out what is secret is the mistake we are avoiding.

    The rectangles are painted solid black, not blurred or pixelated. A good enough model can read through pixelation. It cannot read through black.

    diff --git a/helper/Sources/cmcp-helper/Accessibility.swift b/helper/Sources/cmcp-helper/Accessibility.swift index b58c3ec0..d72eefbc 100644 --- a/helper/Sources/cmcp-helper/Accessibility.swift +++ b/helper/Sources/cmcp-helper/Accessibility.swift @@ -91,13 +91,25 @@ enum AX { /// er tom. Svaret skal derfor sige det, naar netop DETTE kald taendte kontakten. static var chromeTaendtNu = false + /// ⛔ REVIEW 5/11 (Opus, F7): en ren navneliste lod Chrome for Testing (`com.google.chrome.for.testing`, + /// den README'ens egen maaling fra 23/9 brugte) og Chromes kanaler fail-open. Praefikset fanger dem. + /// PWA-skaller (`com.google.Chrome.app.`) og hjaelpeprocessen (`com.google.Chrome.helper`) holdes + /// ude: om skallerne ejer vinduer med et web-omraade er UMAALT, og en port paa et vindue der aldrig + /// viser et, ville svaerte det for altid. Andre Chromium-browsere end listen er ikke daekket. + static func erChromium(_ bundleId: String?) -> Bool { + guard let id = bundleId else { return false } + if chromiumBrowsere.contains(id) { return true } + let lav = id.lowercased() + return lav.hasPrefix("com.google.chrome") && !lav.contains(".app.") && !lav.hasSuffix(".helper") + } + static func taendTrae(_ pid: pid_t) { guard !taendTraeSlaaetFra else { return } guard !traeTaendt.contains(pid) else { return } traeTaendt.insert(pid) let program = AXUIElementCreateApplication(pid) AXUIElementSetAttributeValue(program, "AXManualAccessibility" as CFString, kCFBooleanTrue) - if let id = NSRunningApplication(processIdentifier: pid)?.bundleIdentifier, chromiumBrowsere.contains(id) { + if erChromium(NSRunningApplication(processIdentifier: pid)?.bundleIdentifier) { var nu: CFTypeRef? let varTaendt = AXUIElementCopyAttributeValue(program, "AXEnhancedUserInterface" as CFString, &nu) == .success && (nu as? Bool) == true @@ -115,25 +127,46 @@ enum AX { /// (inspect --format json, Chrome 156) - foerste udgave gik 6 niveauer ned, fandt det aldrig og /// svaertede derfor ALLE Chrome-vinduer, ogsaa dem med bygget indhold. 12 giver luft. static func harWebIndhold(_ win: AXUIElement) -> Bool { + // ⛔ REVIEW 5/11 (Opus, F1): foerste udgave svarede ja ved det FOERSTE web-omraade med indhold. + // Et sidepanel eller en dokket DevTools er sit eget web-indhold og kan vaere bygget foer + // siden - saa slap vinduet gennem porten med en ubygget side. Nu skal ALLE web-omraader + // paa topniveau have indhold (de indlejrede - iframes - gaar vi ikke ned i). var lag = [win] + var omraader: [AXUIElement] = [] for _ in 0..<12 { var naeste: [AXUIElement] = [] for el in lag { - if string(el, kAXRoleAttribute as String) == "AXWebArea" { - if !children(el).isEmpty { return true } - continue - } + if string(el, kAXRoleAttribute as String) == "AXWebArea" { omraader.append(el); continue } naeste.append(contentsOf: children(el)) } - if naeste.isEmpty { return false } + if naeste.isEmpty { break } lag = naeste } + return !omraader.isEmpty && omraader.allSatisfy { !children($0).isEmpty } + } + + + /// Er der et Chrome-vindue med side-stoerrelse, hvis side ikke kan laeses endnu? + /// ⛔ REVIEW 5/11 (Opus) + adfaerdsproeven: `tree_building` kom kun paa det ENE kald der vendte + /// kontakten - og kun hvis det fik 0. Proevens foerste opslag (vinduets titel) vendte den, og + /// det naeste tomme opslag var stumt. En agent konkluderer saa «tom side». Signalet skal + /// afspejle tilstanden, ikke hvem der trykkede. + static func chromeSideUlaeselig(scope: String?) -> Bool { + guard !taendTraeSlaaetFra else { return false } + for app in allApps() where erChromium(app.bundleIdentifier) { + if let s = scope, !passer(app, s) { continue } + for win in windowsMed(of: app).vinduer { + guard let vf = frame(win), vf.w >= 200, vf.h >= 120, + string(win, kAXSubroleAttribute as String) == "AXStandardWindow" else { continue } + if !harWebIndhold(win) { return true } + } + } return false } /// Den ene saetning alle laesende svar bruger, naar svaret kan vaere tomt alene fordi /// Chrome stadig bygger sit trae. - static let chromeByggerNote = "Chrome's page content was switched on for accessibility by this call, and Chrome builds it in the background (measured 3 to 15 seconds). If the page itself is missing from this answer, read again in a few seconds before concluding it is empty." + static let chromeByggerNote = "A Chrome window's page is not readable yet: Chrome builds it in the background after its accessibility is switched on (measured 3 to 15 seconds), or the page is empty. If the page itself is missing from this answer, read again in a few seconds before concluding it is empty." // MARK: - Lavniveau @@ -685,8 +718,7 @@ enum AX { // derfor ikke staa inde for - det svaertes helt, som afviste programmer. // (Med CMCP_INGEN_ELECTRON=1 er traeet slaaet fra med vilje; saa gaelder den // dokumenterede pris, ikke denne faldbag.) - let erChromium = !AX.taendTraeSlaaetFra - && AX.chromiumBrowsere.contains(app.bundleIdentifier ?? "") + let erChromium = !AX.taendTraeSlaaetFra && AX.erChromium(app.bundleIdentifier) var chromeNoteSat = false let axApp = AXUIElementCreateApplication(app.processIdentifier) // Et enkelt haengende opslag maa ikke kunne spise hele budgettet. @@ -755,11 +787,19 @@ enum AX { // vaerktoejslinje som strimler paa 41-47 punkters hoejde, og et paa 13 i // bredden). De har aldrig et web-omraade, og foerste udgave svaertede dem i // HVERT billede. Reglen gaelder kun vinduer der kan rumme en side. - if erChromium, let rf = frame(win), rf.w >= 200, rf.h >= 120, !AX.harWebIndhold(win) { + // ⛔ REVIEW 5/11 (Opus, F2): en ULAESELIG ramme sprang porten over - og under samme belastning + // svarer children() tomt, saa intet blev fundet. Kan rammen eller underrollen ikke laeses, + // behandles vinduet som et sidevindue. Og Chromes egne bobler (adresse-forslag, gem-kodeord, + // tilladelser) er ikke AXStandardWindow; de har aldrig et web-omraade og blev svaertet i + // hvert billede med en falsk note. De gennemgaas nu som foer. + let vf = frame(win), vsub = string(win, kAXSubroleAttribute as String) + let sidevindue = vf == nil || vsub == nil + || (vsub == "AXStandardWindow" && vf!.w >= 200 && vf!.h >= 120) + if erChromium, sidevindue, !AX.harWebIndhold(win) { let hele = frame(win).map { [$0] } ?? cgRammer(pid: app.processIdentifier) out.append(contentsOf: hele.isEmpty ? [indenfor ?? heleSkaermen()] : hele) if !chromeNoteSat { - sloeringStoppede.append((app.localizedName ?? bid) + " (its page content was still being built, so the window was blacked out whole)") + sloeringStoppede.append((app.localizedName ?? bid) + " (its page was not readable yet - still being built, or empty - so the window was blacked out whole)") chromeNoteSat = true } continue @@ -786,10 +826,22 @@ enum AX { // Det er samme regel som porten ovenfor - bare ogsaa midt i et vindue. gennemgangFrist = start.addingTimeInterval(tidsgraense) gennemgangOverskred = false + dybdeRamt = false + let langsommeFoer = langsommeOpslag walk(win, depth: 0, maxDepth: maxDepth) { el, role in if isSecure(el, role: role), let f = frame(el) { out.append(f) } } gennemgangFrist = nil + // ⛔ REVIEW 5/11 (Opus, F5) - og MAALT: et kodefelt under 45 indlejrede grupper laa dybere end + // loftet (40), blev ikke fundet, og vinduet blev ikke svaertet: 0 rektangler. Et opslag der + // loeb toer for tid giver ogsaa et tomt svar i stilhed. I Chrome-sider kan vi derfor ikke + // staa inde for en gennemgang der ramte loftet eller tiden - hele vinduet ud. + if erChromium && !gennemgangOverskred && (dybdeRamt || langsommeOpslag > langsommeFoer) { + let hele = frame(win).map { [$0] } ?? cgRammer(pid: app.processIdentifier) + out.append(contentsOf: hele.isEmpty ? [indenfor ?? heleSkaermen()] : hele) + sloeringStoppede.append((app.localizedName ?? bid) + " (its page went deeper than the scan reaches, or a lookup timed out - window blacked out whole)") + continue + } if gennemgangOverskred { let hele = frame(win).map { [$0] } ?? cgRammer(pid: app.processIdentifier) out.append(contentsOf: hele.isEmpty ? [indenfor ?? heleSkaermen()] : hele) @@ -805,8 +857,11 @@ enum AX { /// Blev fristen overskredet midt i gennemgangen? static var gennemgangOverskred = false + /// Naaede gennemgangen sit dybdeloft med noget under sig? Saettes af `walk`. + static var dybdeRamt = false + private static func walk(_ el: AXUIElement, depth: Int, maxDepth: Int, _ visit: (AXUIElement, String) -> Void) { - guard depth < maxDepth else { return } + guard depth < maxDepth else { dybdeRamt = true; return } if let f = gennemgangFrist, Date() > f { gennemgangOverskred = true; return } let role = string(el, kAXRoleAttribute as String) ?? "" visit(el, role) diff --git a/helper/Sources/cmcp-helper/main.swift b/helper/Sources/cmcp-helper/main.swift index 5429c904..c49db725 100644 --- a/helper/Sources/cmcp-helper/main.swift +++ b/helper/Sources/cmcp-helper/main.swift @@ -504,8 +504,8 @@ case "find": fundSvar["stopped_early"] = true fundSvar["note"] = "The search stopped after \(Int(AX.tidsgraense)) seconds - this app answers slowly, so these are the matches in PART of it, not all. Narrow it with role, subrole, title or a lower depth." } - // ⛔ MAALT 4/11: kaldet der taendte Chromes web-trae, saa 0 - traeet kom 5-15 s senere. - if hits.isEmpty && AX.chromeTaendtNu { + // ⛔ MAALT 4/11: kaldet der taendte Chromes web-trae, saa 0 - traeet kom 3-15 s senere. + if hits.isEmpty && (AX.chromeTaendtNu || AX.chromeSideUlaeselig(scope: args.str("app"))) { fundSvar["tree_building"] = true fundSvar["note"] = AX.chromeByggerNote } @@ -811,7 +811,7 @@ case "focused": Out.ok(["focused": true, "element": f.dict]) } else { Out.ok(["focused": false, - "hint": AX.chromeTaendtNu + "hint": (AX.chromeTaendtNu || AX.chromeSideUlaeselig(scope: NSWorkspace.shared.frontmostApplication?.bundleIdentifier)) ? "no element has keyboard focus yet. " + AX.chromeByggerNote : "no element has keyboard focus - click or press into the field first"]) } diff --git a/mcp-server/README.md b/mcp-server/README.md index e37ee1e3..561a270f 100644 --- a/mcp-server/README.md +++ b/mcp-server/README.md @@ -30,24 +30,30 @@ in the hours you are not watching. This one switches the tree on itself before it looks. Measured on a VS Code fork with two windows open: **0 buttons before, 728 after**, same windows, same moment. `CMCP_INGEN_ELECTRON=1` turns it off if you would rather the app - did not pay for keeping a tree it otherwise would not build. + did not pay for keeping a tree it otherwise would not build - and it turns off + Chrome's switch below too, so Chrome pages are then neither readable nor have + their password fields blacked out. - **Chrome pages are not a blind spot either.** Chrome ignores the Electron switch - asked for it, it answers that the attribute does not exist - and has its own: the one a screen reader sets. This server sets that one in - Chromium browsers. Measured 5 Nov on Chrome 156: a test page went from **0 - page elements to 6**, its password field among them and blacked out; the - redaction scan of a heavy everyday Chrome took 0.2 s. + Google Chrome (every channel, Chrome for Testing included) and in Edge, + Brave, Arc, Vivaldi, Opera and Chromium. Measured 5 Nov on Chrome 156: a + test page went from **0 page elements to 6**, its password field among them + and blacked out; the redaction scan of a heavy everyday Chrome took 0.14 to + 0.54 s. `test/chrome-side-live.mjs` proves it against a real Chrome. Honest limits: macOS only. It reads the accessibility tree, so an app that draws its own controls on a canvas and publishes nothing - some games, some plotting tools - is still a blind spot. **In a browser,** Chrome builds a page's tree in the background the first time it is switched on, which took 3 to 15 -seconds in our measurements; until then a reading answer says `tree_building` -and that Chrome window is blacked out whole in screenshots. Only Google Chrome -is measured; Edge, Brave, Arc, Vivaldi and Opera get the same switch but are -not measured, and Safari and Firefox are not handled. When a browser tool is in -the session, let it do the work inside pages - this server takes over where it -is refused (see the limits below). +seconds in our measurements; until then a search that finds nothing says +`tree_building`, and that Chrome window is blacked out whole in screenshots +(the screenshot only says how many regions were blacked out, not why). Only +Google Chrome is measured. Other Chromium browsers than the ones named above - +Chrome app windows (PWAs) included - are not switched on and not covered, and +Safari and Firefox are not handled. When a browser tool is in the session, let +it do the work inside pages - this server takes over where it is refused (see +the limits below). No account, no API key, no model inside it. MIT. @@ -87,11 +93,15 @@ page expose role `AXTextField` with the *subrole* `AXSecureTextField`. Checking only the role would catch native fields and let every browser password box through - so both are checked. In a web page the field is only found when the browser shows its page to the accessibility layer. In Chrome this server switches -that on (above); while Chrome is still building the page - the first seconds -after it is switched on - the whole Chrome window is blacked out instead of -risking a field it cannot see yet. In a browser it does not switch on (Safari, -Firefox), the field is not painted over; what it shows is the browser's own -dots, unless the page itself shows the password in plain text. +that on (above); while a Chrome window's page is not readable yet - the first +seconds after it is switched on, or an empty page - the whole window is blacked +out instead of risking a field it cannot see. Known gaps, not measured: a login +form inside a cross-site frame, or a second step that appears before Chrome has +updated its tree, can be on screen a moment before the field is in the tree. In +a browser it does not switch on (Safari, Firefox, other Chromium browsers, and +any browser with `CMCP_INGEN_ELECTRON=1`), the field is not painted over; what +it shows is the browser's own dots, unless the page shows the password in plain +text. **2. The dangerous places ask first.** By default the agent works without interrupting you - that is what lets it run while you do something else - and @@ -503,12 +513,22 @@ sit unnoticed until it expires. That is a real limitation today, not a setting. page tree for the switch a real screen reader sets, `AXEnhancedUserInterface`. That is what changed on 9 Oct, when the same Chrome did show its pages: most likely something else had set it (not measured). Since 5 Nov this server sets - it in Chromium browsers itself. Two consequences to know: the first read after - Chrome starts can come back without the page while Chrome builds it, and Chrome - blocks every extension on Chrome Web Store and its developer console ("The - extensions gallery cannot be scripted") - there a browser tool can navigate but - not act, and this server is the one that reads and presses. It finds the right - window by the browser tool's tab group, whose name is in the window title. + it in the browsers named above itself. What that costs and changes, so you can + decide: Chrome keeps its full accessibility mode for every window and profile + until it quits, which costs memory and CPU in Chrome (not measured separately - + Chrome's own memory swung ±500 MB in 30 s); Chrome's windows may animate when + they are moved (the known side effect of this switch, not measured on Chrome); + any call that looks at Chrome switches it on, not only screenshots; and + password managers that run INSIDE Chrome - an extension's popup, a web vault, + Chrome's own password page - can now be read as text by `computer_find` and + `computer_inspect`, where before only their pixels were in a screenshot. Native + password managers are blacked out whole as before; these are not on that list. + `CMCP_INGEN_ELECTRON=1` leaves Chrome's switch off too. And Chrome blocks every + extension on Chrome Web Store and its developer console ("The extensions gallery + cannot be scripted") - there a browser tool can navigate but not act, and this + server can read the page (measured on the developer console). An agent finds + the right window by the browser tool's tab group: the window title contains the + group's name, in Chrome's own interface language. - **Keystrokes do not land in a Chromium window that is not focused.** Measured the same day: the helper reported `typed: 21` and `took_screen: false`, and the text arrived nowhere. `computer_set_value` through the accessibility diff --git a/mcp-server/index.js b/mcp-server/index.js index b70b74b4..bfa9abab 100644 --- a/mcp-server/index.js +++ b/mcp-server/index.js @@ -263,21 +263,23 @@ Reading: \`computer_inspect\` answers as text by default. If it says INCOMPLETE or [cut: ...], the answer is PART of the tree - narrow it with \`computer_find\` rather than trusting what came back. -Web pages in Chrome (and other Chromium browsers): this server sees inside them +Web pages in Google Chrome (also Edge, Brave, Arc, Vivaldi, Opera): this server sees inside them too - headings, links, text fields with their values, and password fields as secure, so they are blacked out in screenshots (measured 5 Nov on Chrome 156: a test page went from 0 page elements to 6, its password field among them as -secure; the scan of a heavy everyday Chrome took 0.2 s). Chrome builds that -content in the background the first time it is asked, which takes 3 to 15 -seconds; an answer that came back without the page says so (\`tree_building\`), -and until it is built, that Chrome window is blacked out whole in screenshots. -Read again before you conclude a page is empty. +secure; the scan of a heavy everyday Chrome took 0.14 to 0.54 s). Chrome builds +that content in the background the first time it is asked, which takes 3 to 15 +seconds; a search that finds nothing while a Chrome page is not readable yet says +so (\`tree_building\`), and until it is built, that Chrome window is blacked out +whole in screenshots. Read again before you conclude a page is empty. Password +managers that run inside Chrome (an extension popup, a web vault) are readable as +text here - do not read them unless the person asked you to. When a browser tool is also in this session (Browser MCP's browser_*), let it do the work inside pages, and take over where it is refused: Chrome blocks EVERY extension on Chrome Web Store and its developer console ("The extensions gallery cannot be scripted"). The browser tool can still navigate there and list its -tabs. Find that window by its tab group: the group's name is in the window title -("... - part of the Claude 2 group - ..."), and browser_list_tabs reports it as +tabs. Find that window by its tab group: the window title contains the group's +name, in Chrome's own interface language, and browser_list_tabs reports it as "session". That name is the link between the two tools. Everything is written to an append-only audit log with a rolling chain.`; diff --git a/test/chrome-dyb-side-live.mjs b/test/chrome-dyb-side-live.mjs new file mode 100644 index 00000000..28777ef0 --- /dev/null +++ b/test/chrome-dyb-side-live.mjs @@ -0,0 +1,79 @@ +// Et kodefelt DYBERE end sloeringens gennemgang naar (dybde 40 fra vinduet) maa ikke slippe igennem. +// +// ⛔ REVIEW 5/11-2026 (Opus, F5): gennemgangen stopper i dybde 40, og siden starter i dybde 8. Et felt +// dybere nede blev hverken fundet eller fik vinduet svaertet. Gustavs rigtige sider gaar til dybde 16 +// (maalt), saa reglen rammer ikke hans daglige brug - men en tungt indlejret side kan gaa dybere. +// Denne side har 45 indlejrede grupper med kodefeltet i bunden. Forventet: hele vinduet svaertes. +// +// (Resten af opstillingen er den samme som chrome-side-live.mjs.) +// Chrome-sider gennem den SENDTE hjaelper - adfaerd, ikke tekst. +// +// ⛔ REVIEW 5/11-2026 (Opus): claims-offline 8b-8e tjekker at strengene STAAR i kilden. Syv af +// otte meningsfulde mutationer forblev groenne - ogsaa «porten svaerter intet» og «kontakten +// saettes aldrig». En proeve der ikke kan blive roed af det den hedder, beviser ingenting. +// Denne kalder hjaelperen mod en rigtig Chrome og maaler det der skal vaere sandt: +// +// 1. kaldet der TAENDER Chromes trae, svarer tree_building (ikke et stumt 0) +// 2. mens siden bygges, svaertes HELE vinduet (fail-closed) - kodefeltet kan ikke ses endnu +// 3. naar siden er bygget, ses den: tekstfeltet findes +// 4. og saa svaertes KUN kodefeltet, ikke hele vinduet +// 5. skrivning i tekstfeltet bekraeftes, laest tilbage +// 6. skrivning i kodefeltet naegtes (secure-field) +// +// Koeres bevidst: `node test/chrome-side-live.mjs`. Den roerer hverken mus eller tastatur, men den +// aabner et lille Chrome-vindue med en engangs-profil i et par sekunder, og hjaelperen taender +// Chromes trae ogsaa i dit eget Chrome (det er produktets adfaerd). Uden Google Chrome: UMAALT. +import { execFileSync, spawn } from 'node:child_process'; +import { existsSync, mkdtempSync, writeFileSync, rmSync } from 'node:fs'; +import { tmpdir } from 'node:os'; +import { join, dirname } from 'node:path'; +import { fileURLToPath } from 'node:url'; + +const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..'); +const H = process.env.CMCP_HELPER || join(ROOT, 'mcp-server', 'vendor', 'cmcp-helper'); +const CHROME = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'; +if (!existsSync(CHROME)) { console.log('UMAALT Google Chrome er ikke installeret her'); process.exit(0); } + +let fejl = 0; +const check = (navn, ok, hvorfor) => { console.log(`${ok ? 'OK ' : 'DUMP'} ${navn}${ok ? '' : ' - ' + hvorfor}`); if (!ok) fejl++; }; +const hj = (args, stdin) => JSON.parse(execFileSync(H, args, { input: stdin, encoding: 'utf8', timeout: 60000 })); +const vent = (ms) => new Promise((r) => setTimeout(r, ms)); + +const mappe = mkdtempSync(join(tmpdir(), 'cmcp-chrome-')); +const side = join(mappe, 'side.html'); +writeFileSync(side, `CMCP-LIVE +

    CMCPLIVEOVERSKRIFT

    + +${'
    '.repeat(45)}${'
    '.repeat(45)} +`); +// Vinduets plads og stoerrelse er kendte, saa svarene kan holdes op mod netop det vindue - +// hjaelperen ser ogsaa personens eget Chrome. +const V = { x: 40, y: 80, w: 760, h: 560 }; +const chrome = spawn(CHROME, [`--user-data-dir=${join(mappe, 'profil')}`, '--no-first-run', '--no-default-browser-check', + '--disable-extensions', '--disable-session-crashed-bubble', `--window-position=${V.x},${V.y}`, `--window-size=${V.w},${V.h}`, + `file://${side}`], { stdio: 'ignore', detached: true }); +const ryd = () => { try { process.kill(-chrome.pid); } catch {} try { chrome.kill('SIGKILL'); } catch {} try { rmSync(mappe, { recursive: true, force: true }); } catch {} }; +process.on('exit', ryd); + +const iVinduet = (r) => r.x >= V.x - 4 && r.y >= V.y - 4 && r.x + r.w <= V.x + V.w + 4 && r.y + r.h <= V.y + V.h + 4; +const heleVinduet = (r) => Math.abs(r.w - V.w) <= 8 && Math.abs(r.h - V.h) <= 8; + +try { + // Vent til vinduet findes for Chromes egen brugerflade (titlen), FOER traeet roeres. + let set = false; + for (let i = 0; i < 40 && !set; i++) { await vent(250); set = hj(['find', '--app', 'com.google.Chrome', '--contains', 'CMCP-LIVE', '--depth', '6']).count > 0; } + check('0. test-vinduet er aabnet', set, 'Chrome viste ikke vinduet paa 10 s'); + + // Vent til siden er bygget (tekstfeltet ses), saa svaret ikke handler om opbygningen. + let f = { count: 0 }; + for (let i = 0; i < 60 && !f.count; i++) { await vent(500); f = hj(['find', '--app', 'com.google.Chrome', '--contains', 'CMCPLIVEFELT', '--depth', '60']); } + check('1. siden er bygget (tekstfeltet ses)', f.count > 0, 'ikke fundet paa 30 s'); + const dyb = hj(['find', '--app', 'com.google.Chrome', '--contains', 'CMCPLIVEKODE', '--depth', '80']); + check('2. kodefeltet ligger dybere end sloeringens 40 (fundet med dybde 80)', dyb.count > 0, 'Chrome viser ikke de indlejrede grupper som lag'); + const r = hj(['secure-rects', '--app', 'com.google.Chrome']).rects.filter(iVinduet); + check('3. et felt sloeringen ikke naar, svaerter HELE vinduet', r.some(heleVinduet), `kun ${JSON.stringify(r)}`); +} finally { + ryd(); +} +console.log(fejl ? `\n${fejl} DUMPET` : '\nBESTAAET'); +process.exit(fejl ? 1 : 0); diff --git a/test/chrome-side-live.mjs b/test/chrome-side-live.mjs new file mode 100644 index 00000000..020a7a27 --- /dev/null +++ b/test/chrome-side-live.mjs @@ -0,0 +1,96 @@ +// Chrome-sider gennem den SENDTE hjaelper - adfaerd, ikke tekst. +// +// ⛔ REVIEW 5/11-2026 (Opus): claims-offline 8b-8e tjekker at strengene STAAR i kilden. Syv af +// otte meningsfulde mutationer forblev groenne - ogsaa «porten svaerter intet» og «kontakten +// saettes aldrig». En proeve der ikke kan blive roed af det den hedder, beviser ingenting. +// Denne kalder hjaelperen mod en rigtig Chrome og maaler det der skal vaere sandt: +// +// 1. kaldet der TAENDER Chromes trae, svarer tree_building (ikke et stumt 0) +// 2. mens siden bygges, svaertes HELE vinduet (fail-closed) - kodefeltet kan ikke ses endnu +// 3. naar siden er bygget, ses den: tekstfeltet findes +// 4. og saa svaertes KUN kodefeltet, ikke hele vinduet +// 5. skrivning i tekstfeltet bekraeftes, laest tilbage +// 6. skrivning i kodefeltet naegtes (secure-field) +// +// Koeres bevidst: `node test/chrome-side-live.mjs`. Den roerer hverken mus eller tastatur, men den +// aabner et lille Chrome-vindue med en engangs-profil i et par sekunder, og hjaelperen taender +// Chromes trae ogsaa i dit eget Chrome (det er produktets adfaerd). Uden Google Chrome: UMAALT. +import { execFileSync, spawn } from 'node:child_process'; +import { existsSync, mkdtempSync, writeFileSync, rmSync } from 'node:fs'; +import { tmpdir } from 'node:os'; +import { join, dirname } from 'node:path'; +import { fileURLToPath } from 'node:url'; + +const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..'); +const H = process.env.CMCP_HELPER || join(ROOT, 'mcp-server', 'vendor', 'cmcp-helper'); +const CHROME = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'; +if (!existsSync(CHROME)) { console.log('UMAALT Google Chrome er ikke installeret her'); process.exit(0); } + +let fejl = 0; +const check = (navn, ok, hvorfor) => { console.log(`${ok ? 'OK ' : 'DUMP'} ${navn}${ok ? '' : ' - ' + hvorfor}`); if (!ok) fejl++; }; +const hj = (args, stdin) => JSON.parse(execFileSync(H, args, { input: stdin, encoding: 'utf8', timeout: 60000 })); +const vent = (ms) => new Promise((r) => setTimeout(r, ms)); + +const mappe = mkdtempSync(join(tmpdir(), 'cmcp-chrome-')); +const side = join(mappe, 'side.html'); +writeFileSync(side, `CMCP-LIVE +

    CMCPLIVEOVERSKRIFT

    + +

    `); +// Vinduets plads og stoerrelse er kendte, saa svarene kan holdes op mod netop det vindue - +// hjaelperen ser ogsaa personens eget Chrome. +const V = { x: 40, y: 80, w: 760, h: 560 }; +const chrome = spawn(CHROME, [`--user-data-dir=${join(mappe, 'profil')}`, '--no-first-run', '--no-default-browser-check', + '--disable-extensions', '--disable-session-crashed-bubble', `--window-position=${V.x},${V.y}`, `--window-size=${V.w},${V.h}`, + `file://${side}`], { stdio: 'ignore', detached: true }); +const ryd = () => { try { process.kill(-chrome.pid); } catch {} try { chrome.kill('SIGKILL'); } catch {} try { rmSync(mappe, { recursive: true, force: true }); } catch {} }; +process.on('exit', ryd); + +const iVinduet = (r) => r.x >= V.x - 4 && r.y >= V.y - 4 && r.x + r.w <= V.x + V.w + 4 && r.y + r.h <= V.y + V.h + 4; +const heleVinduet = (r) => Math.abs(r.w - V.w) <= 8 && Math.abs(r.h - V.h) <= 8; + +try { + // Vent til vinduet findes for Chromes egen brugerflade (titlen), FOER traeet roeres. + let set = false; + for (let i = 0; i < 40 && !set; i++) { await vent(250); set = hj(['find', '--app', 'com.google.Chrome', '--contains', 'CMCP-LIVE', '--depth', '6']).count > 0; } + check('0. test-vinduet er aabnet', set, 'Chrome viste ikke vinduet paa 10 s'); + + // 1. Det kald der taender traeet, ser ikke siden endnu - og skal sige hvorfor. + const f1 = hj(['find', '--app', 'com.google.Chrome', '--contains', 'CMCPLIVEFELT', '--depth', '60']); + check('1. det taendende kald svarer tree_building, ikke et stumt 0', + f1.count === 0 && f1.tree_building === true, JSON.stringify(f1).slice(0, 160)); + + // 2. Lige efter: traeet bygges stadig - hele vinduet svaertes. + const r2 = hj(['secure-rects', '--app', 'com.google.Chrome']).rects.filter(iVinduet); + check('2. mens siden bygges, svaertes HELE test-vinduet', r2.some(heleVinduet), + `ingen hele-vindue-rektangel i ${JSON.stringify(r2)}`); + + // 3. Siden kommer. + let f3 = { count: 0 }; + for (let i = 0; i < 60 && !f3.count; i++) { await vent(500); f3 = hj(['find', '--app', 'com.google.Chrome', '--contains', 'CMCPLIVEFELT', '--depth', '60']); } + check('3. siden ses: tekstfeltet findes', f3.count > 0 && f3.matches.some((m) => m.role === 'AXTextArea'), 'ikke fundet paa 30 s'); + + // 4. Nu svaertes kodefeltet - og IKKE hele vinduet. + const r4 = hj(['secure-rects', '--app', 'com.google.Chrome']).rects.filter(iVinduet); + check('4. kun kodefeltet svaertes, ikke hele vinduet', + r4.length >= 1 && !r4.some(heleVinduet) && r4.some((r) => r.w < 400 && r.h < 60), JSON.stringify(r4)); + + // 5. Skrivning bekraeftes og laeses tilbage. + const s5 = hj(['set-value', '--match-stdin', '--app', 'com.google.Chrome', '--role', 'AXTextArea'], + JSON.stringify({ contains: 'CMCPLIVEFELT', text: 'skrevet af proeven' })); + const tilbage = hj(['find', '--app', 'com.google.Chrome', '--contains', 'CMCPLIVEFELT', '--role', 'AXTextArea', '--depth', '60']); + check('5. skrivning i tekstfeltet er verified og laest tilbage', + s5.ok === true && s5.verified === true && JSON.stringify(tilbage.matches?.[0]?.names || []).includes('skrevet af proeven'), + JSON.stringify(s5).slice(0, 160)); + + // 6. Kodefeltet naegtes. + let s6; + try { s6 = hj(['set-value', '--match-stdin', '--app', 'com.google.Chrome', '--subrole', 'AXSecureTextField'], + JSON.stringify({ contains: 'CMCPLIVEKODE', text: 'maa-aldrig-lande' })); } + catch (e) { s6 = JSON.parse(e.stdout || '{}'); } + check('6. skrivning i kodefeltet naegtes', s6.ok === false && s6.code === 'secure-field', JSON.stringify(s6).slice(0, 160)); +} finally { + ryd(); +} +console.log(fejl ? `\n${fejl} DUMPET` : '\nBESTAAET'); +process.exit(fejl ? 1 : 0); diff --git a/test/claims-offline.mjs b/test/claims-offline.mjs index 7672ca0d..f03a1273 100644 --- a/test/claims-offline.mjs +++ b/test/claims-offline.mjs @@ -137,20 +137,20 @@ check('den taendes kun én gang pr. proces', // animerer den vinduesflytninger, og dem ser vi i forvejen. const tStart = sw.indexOf('static func taendTrae'); const hel = sw.slice(tStart, sw.indexOf('\n }\n', tStart) + 6); -const foerTjek = hel.slice(0, hel.indexOf('chromiumBrowsere.contains(id)')); +const foerTjek = hel.slice(0, hel.indexOf('erChromium(')); check('Chrome faar sin egen kontakt, AXEnhancedUserInterface', /AXUIElementSetAttributeValue\(program, "AXEnhancedUserInterface" as CFString, kCFBooleanTrue\)/.test(hel), 'uden den er Chrome-siderne tomme for os'); check('... men kun bag Chromium-tjekket, aldrig paa alle programmer', - hel.includes('chromiumBrowsere.contains(id)') && !/AXEnhancedUserInterface/.test(foerTjek), + hel.includes('erChromium(') && !/AXEnhancedUserInterface/.test(foerTjek), 'saat paa alle programmer animerer den vinduer i AppKit-programmer'); // 8c. Traeet bygges ASYNKRONT (maalt 3-15 s, fire gange). Det kald der taendte det, maa ikke svare et // stumt «0» - saa konkluderer agenten at siden er tom. const mainSw = readFileSync(new URL('../helper/Sources/cmcp-helper/main.swift', import.meta.url), 'utf8'); check('find siger det, naar kaldet selv lige taendte Chrome-traeet', - /hits\.isEmpty && AX\.chromeTaendtNu[^]{0,120}tree_building/.test(mainSw), + /hits\.isEmpty && \(AX\.chromeTaendtNu \|\| AX\.chromeSideUlaeselig\([^]{0,160}tree_building/.test(mainSw), 'et foerste «0» laeses som en tom side'); -check('focused siger det ogsaa', /AX\.chromeTaendtNu\s*\?[^]{0,80}chromeByggerNote/.test(mainSw), +check('focused siger det ogsaa', /\(AX\.chromeTaendtNu \|\| AX\.chromeSideUlaeselig\([^]{0,160}chromeByggerNote/.test(mainSw), 'computer_type afviser med focus-unknown uden at sige hvorfor'); // 8d. ⛔ MAALT 5/11: web-omraadet ligger i DYBDE 8. Foerste udgave af harWebIndhold soegte 6 // niveauer, fandt det aldrig, og svaertede derfor ALLE Chrome-vinduer i hvert billede. @@ -159,7 +159,7 @@ const niv = Number((hw.match(/for _ in 0\.\.<(\d+)/) || [])[1] || 0); check('harWebIndhold soeger dybere end web-omraadet (dybde 8)', niv >= 9, `soeger ${niv} niveauer`); // 8e. Chromes titelloese hjaelpe-vinduer (41-47 pkt hoeje strimler) har aldrig et web-omraade. check('kun vinduer med side-stoerrelse svaertes for et ubygget trae', - /rf\.w >= 200, rf\.h >= 120, !AX\.harWebIndhold\(win\)/.test(sw), + /vsub == "AXStandardWindow" && vf!\.w >= 200 && vf!\.h >= 120/.test(sw) && /erChromium, sidevindue, !AX\.harWebIndhold\(win\)/.test(sw), 'ellers svaertes fanelinje og vaerktoejslinje i hvert billede'); check('Google Chrome staar paa listen', /"com\.google\.Chrome"/.test(sw), 'den eneste browser der er maalt'); @@ -191,6 +191,8 @@ const LOEFTER = [ ['AXSecureTextField', 'kodeordsfelter kan findes og sloeres'], ['AXMenu', 'menuer kan laeses'], ['CMCP_INGEN_ELECTRON', 'Electron-kontakten kan slaas fra af brugeren'], + // REVIEW 5/11 (Opus): uden den kunne en gammel binaer bestaa - samme klasse som 21/9. + ['AXEnhancedUserInterface', 'Chrome-sider kan ses, og deres kodefelter sloeres'], ]; const BIN = join(ROOT, 'mcp-server', 'vendor', 'cmcp-helper'); let raa = null; From eaa2e2b2c4985f805bcfce021c931643352ce8dd Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Thu, 5 Nov 2026 02:10:11 +0100 Subject: [PATCH 36/94] Frister paa alle nye Chrome-soegninger, og live-proeverne maaler ikke en laast skaerm MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit MAALT kl. ~02: med Chromes tilgaengelighed langsom HANG den udrullede hjaelper (7dea134) i over 40 s paa et Chrome-skan, mens den oprindelige ramte sit loft paa 10 s og gik videre. harWebIndhold, porten i sloeringen og tree_building-tjekket havde ingen frist. Nu har de: naaes fristen, er vinduet «ikke laesbart» og svaertes, som resten af sloeringen goer ved et loft. Maalt efter rettelsen paa det samme langsomme Chrome: 10,3 s (som den oprindelige), et tomt find 0,1 s. Ingen haenger. Udrulningen blev rullet tilbage til den oprindelige hjaelper foer rettelsen; denne commit er IKKE udrullet. Live-proeverne skal foerst vaere groenne paa den, og det kan de ikke vaere nu: MAALT at Chrome ikke bygger siders trae mens Mac'en er laast (et maaleprogram uden hjaelperen: 0 web-omraader efter 25,6 s, mod 2,1 s ulaast). Proeverne siger derfor UMAALT ved en laast skaerm. claims-offline 8f binder fristerne. LOEFTER-tjekket er roedt med vilje: den sendte binaer er den oprindelige og baerer ikke Chrome-kontakten - det er praecis den forældede binaer, tjekket findes for. Co-Authored-By: Claude Opus 5.5 --- helper/Sources/cmcp-helper/Accessibility.swift | 16 ++++++++++++---- test/chrome-dyb-side-live.mjs | 7 +++++++ test/chrome-side-live.mjs | 7 +++++++ test/claims-offline.mjs | 11 ++++++++++- 4 files changed, 36 insertions(+), 5 deletions(-) diff --git a/helper/Sources/cmcp-helper/Accessibility.swift b/helper/Sources/cmcp-helper/Accessibility.swift index d72eefbc..ecf20668 100644 --- a/helper/Sources/cmcp-helper/Accessibility.swift +++ b/helper/Sources/cmcp-helper/Accessibility.swift @@ -126,7 +126,12 @@ enum AX { /// Bredde-foerst og stopper ved foerste fund. ⛔ MAALT 4/11: omraadet ligger i DYBDE 8 /// (inspect --format json, Chrome 156) - foerste udgave gik 6 niveauer ned, fandt det aldrig og /// svaertede derfor ALLE Chrome-vinduer, ogsaa dem med bygget indhold. 12 giver luft. - static func harWebIndhold(_ win: AXUIElement) -> Bool { + /// ⛔ MAALT 5/11 kl. ~02: med Chromes tilgaengelighed langsom (System Events kunne ikke hente + /// vinduernes navne) HANG den udrullede hjaelper i over 40 s paa et Chrome-skan, mens den + /// oprindelige ramte sit loft paa 10 s og gik videre. Denne soegning havde ingen frist. Nu har + /// den: er fristen naaet, kan vi ikke staa inde for vinduet, og svaret er «ikke laesbart» - + /// saa svaertes det, som resten af sloeringen goer ved et loft. + static func harWebIndhold(_ win: AXUIElement, frist: Date = .distantFuture) -> Bool { // ⛔ REVIEW 5/11 (Opus, F1): foerste udgave svarede ja ved det FOERSTE web-omraade med indhold. // Et sidepanel eller en dokket DevTools er sit eget web-indhold og kan vaere bygget foer // siden - saa slap vinduet gennem porten med en ubygget side. Nu skal ALLE web-omraader @@ -136,13 +141,14 @@ enum AX { for _ in 0..<12 { var naeste: [AXUIElement] = [] for el in lag { + if Date() > frist { return false } if string(el, kAXRoleAttribute as String) == "AXWebArea" { omraader.append(el); continue } naeste.append(contentsOf: children(el)) } if naeste.isEmpty { break } lag = naeste } - return !omraader.isEmpty && omraader.allSatisfy { !children($0).isEmpty } + return !omraader.isEmpty && omraader.allSatisfy { Date() <= frist && !children($0).isEmpty } } @@ -153,12 +159,14 @@ enum AX { /// afspejle tilstanden, ikke hvem der trykkede. static func chromeSideUlaeselig(scope: String?) -> Bool { guard !taendTraeSlaaetFra else { return false } + let frist = Date().addingTimeInterval(3) for app in allApps() where erChromium(app.bundleIdentifier) { if let s = scope, !passer(app, s) { continue } for win in windowsMed(of: app).vinduer { + if Date() > frist { return true } guard let vf = frame(win), vf.w >= 200, vf.h >= 120, string(win, kAXSubroleAttribute as String) == "AXStandardWindow" else { continue } - if !harWebIndhold(win) { return true } + if !harWebIndhold(win, frist: frist) { return true } } } return false @@ -795,7 +803,7 @@ enum AX { let vf = frame(win), vsub = string(win, kAXSubroleAttribute as String) let sidevindue = vf == nil || vsub == nil || (vsub == "AXStandardWindow" && vf!.w >= 200 && vf!.h >= 120) - if erChromium, sidevindue, !AX.harWebIndhold(win) { + if erChromium, sidevindue, !AX.harWebIndhold(win, frist: start.addingTimeInterval(tidsgraense)) { let hele = frame(win).map { [$0] } ?? cgRammer(pid: app.processIdentifier) out.append(contentsOf: hele.isEmpty ? [indenfor ?? heleSkaermen()] : hele) if !chromeNoteSat { diff --git a/test/chrome-dyb-side-live.mjs b/test/chrome-dyb-side-live.mjs index 28777ef0..0679e68f 100644 --- a/test/chrome-dyb-side-live.mjs +++ b/test/chrome-dyb-side-live.mjs @@ -33,6 +33,13 @@ const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..'); const H = process.env.CMCP_HELPER || join(ROOT, 'mcp-server', 'vendor', 'cmcp-helper'); const CHROME = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'; if (!existsSync(CHROME)) { console.log('UMAALT Google Chrome er ikke installeret her'); process.exit(0); } +// ⛔ MAALT 5/11 kl. 02.09: mens Mac'en er LAAST, bygger Chrome ikke siders tilgaengeligheds-trae. +// Et maaleprogram uden hjaelperen fandt 0 web-omraader efter 25,6 s paa en frisk Chrome (laast), +// mod 2,1 s kl. 01.20 (ulaast). Proeven maaler da laasen, ikke koden - saa den siger UMAALT. +{ + const io = execFileSync('ioreg', ['-n', 'Root', '-d1'], { encoding: 'utf8' }); + if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) { console.log('UMAALT skaermen er laast - Chrome bygger ingen sider imens'); process.exit(0); } +} let fejl = 0; const check = (navn, ok, hvorfor) => { console.log(`${ok ? 'OK ' : 'DUMP'} ${navn}${ok ? '' : ' - ' + hvorfor}`); if (!ok) fejl++; }; diff --git a/test/chrome-side-live.mjs b/test/chrome-side-live.mjs index 020a7a27..0e8b6aba 100644 --- a/test/chrome-side-live.mjs +++ b/test/chrome-side-live.mjs @@ -25,6 +25,13 @@ const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..'); const H = process.env.CMCP_HELPER || join(ROOT, 'mcp-server', 'vendor', 'cmcp-helper'); const CHROME = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'; if (!existsSync(CHROME)) { console.log('UMAALT Google Chrome er ikke installeret her'); process.exit(0); } +// ⛔ MAALT 5/11 kl. 02.09: mens Mac'en er LAAST, bygger Chrome ikke siders tilgaengeligheds-trae. +// Et maaleprogram uden hjaelperen fandt 0 web-omraader efter 25,6 s paa en frisk Chrome (laast), +// mod 2,1 s kl. 01.20 (ulaast). Proeven maaler da laasen, ikke koden - saa den siger UMAALT. +{ + const io = execFileSync('ioreg', ['-n', 'Root', '-d1'], { encoding: 'utf8' }); + if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) { console.log('UMAALT skaermen er laast - Chrome bygger ingen sider imens'); process.exit(0); } +} let fejl = 0; const check = (navn, ok, hvorfor) => { console.log(`${ok ? 'OK ' : 'DUMP'} ${navn}${ok ? '' : ' - ' + hvorfor}`); if (!ok) fejl++; }; diff --git a/test/claims-offline.mjs b/test/claims-offline.mjs index f03a1273..2609cddd 100644 --- a/test/claims-offline.mjs +++ b/test/claims-offline.mjs @@ -158,8 +158,17 @@ const hw = sw.slice(sw.indexOf('static func harWebIndhold'), sw.indexOf('static const niv = Number((hw.match(/for _ in 0\.\.<(\d+)/) || [])[1] || 0); check('harWebIndhold soeger dybere end web-omraadet (dybde 8)', niv >= 9, `soeger ${niv} niveauer`); // 8e. Chromes titelloese hjaelpe-vinduer (41-47 pkt hoeje strimler) har aldrig et web-omraade. +// 8f. ⛔ MAALT 5/11: uden frist HANG hjaelperen > 40 s paa et Chrome-skan, da Chromes tilgaengelighed var +// langsom - den oprindelige ramte sit loft paa 10 s. Alle nye Chrome-soegninger skal bære en frist. +check('harWebIndhold har en frist og svarer «ikke laesbart» naar den er naaet', + /static func harWebIndhold\(_ win: AXUIElement, frist: Date/.test(sw) && /if Date\(\) > frist \{ return false \}/.test(sw), + 'en langsom Chrome faar sloeringen til at haenge forbi serverens 45 s'); +check('porten i sloeringen giver den gennemgangens frist', + /!AX\.harWebIndhold\(win, frist: start\.addingTimeInterval\(tidsgraense\)\)/.test(sw), 'porten kan haenge uden loft'); +check('tree_building-tjekket har sin egen frist', /let frist = Date\(\)\.addingTimeInterval\(3\)/.test(sw) && /harWebIndhold\(win, frist: frist\)/.test(sw), + 'et tomt find kan haenge'); check('kun vinduer med side-stoerrelse svaertes for et ubygget trae', - /vsub == "AXStandardWindow" && vf!\.w >= 200 && vf!\.h >= 120/.test(sw) && /erChromium, sidevindue, !AX\.harWebIndhold\(win\)/.test(sw), + /vsub == "AXStandardWindow" && vf!\.w >= 200 && vf!\.h >= 120/.test(sw) && /erChromium, sidevindue, !AX\.harWebIndhold\(win/.test(sw), 'ellers svaertes fanelinje og vaerktoejslinje i hvert billede'); check('Google Chrome staar paa listen', /"com\.google\.Chrome"/.test(sw), 'den eneste browser der er maalt'); From a0b645618ae57b6fc8cf71b5656b7832f3c436ec Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Thu, 5 Nov 2026 06:37:44 +0100 Subject: [PATCH 37/94] Live-proeven venter paa vinduet uden at taende Chromes trae Maalt 5/11 kl. 06.35 (ulaast, lav belastning): vente-kaldet i trin 0 taendte selv traeet, og Chrome naaede at bygge siden foer trin 1. Trin 1-2 var roede, mens hjaelperen opfoerte sig rigtigt. Trin 0 koerer nu med CMCP_INGEN_ELECTRON=1, saa trin 1 er det foerste kald der roerer kontakten. 7/7 to gange paa eaa2e2b. Co-Authored-By: Claude Opus 5.5 --- test/chrome-side-live.mjs | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/test/chrome-side-live.mjs b/test/chrome-side-live.mjs index 0e8b6aba..be9701b6 100644 --- a/test/chrome-side-live.mjs +++ b/test/chrome-side-live.mjs @@ -35,7 +35,7 @@ if (!existsSync(CHROME)) { console.log('UMAALT Google Chrome er ikke installere let fejl = 0; const check = (navn, ok, hvorfor) => { console.log(`${ok ? 'OK ' : 'DUMP'} ${navn}${ok ? '' : ' - ' + hvorfor}`); if (!ok) fejl++; }; -const hj = (args, stdin) => JSON.parse(execFileSync(H, args, { input: stdin, encoding: 'utf8', timeout: 60000 })); +const hj = (args, stdin, env) => JSON.parse(execFileSync(H, args, { input: stdin, encoding: 'utf8', timeout: 60000, env: env ? { ...process.env, ...env } : process.env })); const vent = (ms) => new Promise((r) => setTimeout(r, ms)); const mappe = mkdtempSync(join(tmpdir(), 'cmcp-chrome-')); @@ -58,8 +58,11 @@ const heleVinduet = (r) => Math.abs(r.w - V.w) <= 8 && Math.abs(r.h - V.h) <= 8; try { // Vent til vinduet findes for Chromes egen brugerflade (titlen), FOER traeet roeres. + // ⛔ MAALT 5/11 kl. 06.35: uden CMCP_INGEN_ELECTRON taendte VENTE-kaldet selv traeet. Ulaast og med + // lav belastning naaede Chrome at bygge siden, foer trin 1 koerte, saa trin 1-2 var roede, mens + // koden opfoerte sig rigtigt. Proeven maalte et kapløb, ikke det foerste kald. let set = false; - for (let i = 0; i < 40 && !set; i++) { await vent(250); set = hj(['find', '--app', 'com.google.Chrome', '--contains', 'CMCP-LIVE', '--depth', '6']).count > 0; } + for (let i = 0; i < 40 && !set; i++) { await vent(250); set = hj(['find', '--app', 'com.google.Chrome', '--contains', 'CMCP-LIVE', '--depth', '6'], undefined, { CMCP_INGEN_ELECTRON: '1' }).count > 0; } check('0. test-vinduet er aabnet', set, 'Chrome viste ikke vinduet paa 10 s'); // 1. Det kald der taender traeet, ser ikke siden endnu - og skal sige hvorfor. From 2e5eacf1c5df1936e5816e0904bc0ee794005f18 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Thu, 5 Nov 2026 06:52:01 +0100 Subject: [PATCH 38/94] Proeve: Chrome-sider gennem MCP-serveren, med netop den hjaelper der skal udrulles Maalt 5/11 kl. 06.44: chats koerer index.js fra arbejdskopien, men CMCP_HELPER i ~/.claude.json peger paa hovedmappens hjaelper fra 23/10 (uden Chromes kontakt). Nattens bevis gennem vaerktoejet var derfor den gamle hjaelper paa en side som den nye havde taendt. Proeven starter sin egen server: tree_building naar klienten, og siden ses. Kalibreret: med 23/10-hjaelperen er trin 1-2 roede. Skrivningen siger UMAALT, naar personen arbejder i Chrome (vagten venter, som den skal). Co-Authored-By: Claude Opus 5.5 --- test/chrome-mcp-live.mjs | 101 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 101 insertions(+) create mode 100644 test/chrome-mcp-live.mjs diff --git a/test/chrome-mcp-live.mjs b/test/chrome-mcp-live.mjs new file mode 100644 index 00000000..b37990ec --- /dev/null +++ b/test/chrome-mcp-live.mjs @@ -0,0 +1,101 @@ +// Chrome-sider gennem MCP-SERVEREN - den vej en chat gaar, ikke hjaelperen alene. +// +// ⛔ MAALT 5/11 kl. 06.44: alle chats' computer-mcp koerer index.js herfra, men CMCP_HELPER i +// ~/.claude.json peger paa hovedmappens hjaelper (bygget 23/10, uden Chromes kontakt). Nattens +// «bevis gennem MCP-vaerktoejet» var den gamle hjaelper, der laeste en side som mine direkte kald +// med den nye havde taendt. Et bevis gennem vaerktoejet skal derfor starte sin EGEN server med +// netop den hjaelper der skal udrulles - og maale paa et Chrome-vindue ingen andre har roert. +// +// 1. serverens foerste find paa en ubygget side svarer tree_building (feltet naar frem til klienten) +// 2. siden ses gennem serveren +// 3. computer_set_value skriver i tekstfeltet, verified +// 4. computer_set_value paa kodefeltet naegtes (secure-field) +// +// Koeres bevidst: `node test/chrome-mcp-live.mjs`. Hjaelperen: CMCP_HELPER, ellers vendor/cmcp-helper. +// Roerer hverken mus eller tastatur. Aabner et lille Chrome-vindue med en engangs-profil. +import { execFileSync, spawn } from 'node:child_process'; +import { existsSync, mkdtempSync, writeFileSync, rmSync } from 'node:fs'; +import { tmpdir } from 'node:os'; +import { join, dirname } from 'node:path'; +import { fileURLToPath } from 'node:url'; + +const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..'); +const H = process.env.CMCP_HELPER || join(ROOT, 'mcp-server', 'vendor', 'cmcp-helper'); +const CHROME = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'; +if (!existsSync(CHROME)) { console.log('UMAALT Google Chrome er ikke installeret her'); process.exit(0); } +{ + const io = execFileSync('ioreg', ['-n', 'Root', '-d1'], { encoding: 'utf8' }); + if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) { console.log('UMAALT skaermen er laast - Chrome bygger ingen sider imens'); process.exit(0); } +} + +let fejl = 0; +const check = (navn, ok, hvorfor) => { console.log(`${ok ? 'OK ' : 'DUMP'} ${navn}${ok ? '' : ' - ' + hvorfor}`); if (!ok) fejl++; }; +const vent = (ms) => new Promise((r) => setTimeout(r, ms)); +// Et entydigt maerke pr. koersel: et vindue fra en tidligere koersel kan ikke give et svar. +const M = `CMCPSRV${Date.now().toString(36).toUpperCase()}`; + +const mappe = mkdtempSync(join(tmpdir(), 'cmcp-chrome-mcp-')); +const side = join(mappe, 'side.html'); +writeFileSync(side, `${M}-TITEL +

    ${M}

    + +

    `); +const chrome = spawn(CHROME, [`--user-data-dir=${join(mappe, 'profil')}`, '--no-first-run', '--no-default-browser-check', + '--disable-extensions', '--disable-session-crashed-bubble', '--window-position=60,90', '--window-size=720,520', + `file://${side}`], { stdio: 'ignore', detached: true }); +const state = mkdtempSync(join(tmpdir(), 'cmcp-chrome-mcp-state-')); + +const { Client } = await import(join(ROOT, 'mcp-server', 'node_modules', '@modelcontextprotocol', 'sdk', 'dist', 'esm', 'client', 'index.js')); +const { StdioClientTransport } = await import(join(ROOT, 'mcp-server', 'node_modules', '@modelcontextprotocol', 'sdk', 'dist', 'esm', 'client', 'stdio.js')); +const env = { ...process.env, CMCP_HELPER: H, CMCP_STATE_DIR: state, CMCP_STATUS_IKON: '0', CMCP_MODE: 'allow', CMCP_SCREEN_ASK: '0' }; +delete env.CMCP_BACKGROUND; +const tr = new StdioClientTransport({ command: process.execPath, args: [join(ROOT, 'mcp-server', 'index.js')], env, stderr: 'ignore' }); +const kl = new Client({ name: 'chrome-mcp-live', version: '1' }); +const ryd = () => { try { process.kill(-chrome.pid); } catch {} try { chrome.kill('SIGKILL'); } catch {} + for (const m of [mappe, state]) { try { rmSync(m, { recursive: true, force: true }); } catch {} } }; +process.on('exit', ryd); + +// Svaret som klienten ser det: teksten i foerste indholdsblok, som JSON hvis den er det. +const kald = async (name, args) => { + const r = await kl.callTool({ name, arguments: args }); + const tekst = (r.content || []).filter((c) => c.type === 'text').map((c) => c.text).join('\n'); + let json = null; try { json = JSON.parse(tekst); } catch { const m = tekst.match(/\{[\s\S]*\}/); if (m) { try { json = JSON.parse(m[0]); } catch {} } } + return { fejl: !!r.isError, tekst, json }; +}; + +try { + // Vent paa vinduet UDEN at taende traeet (CMCP_INGEN_ELECTRON), saa serverens kald er det foerste. + let set = false; + for (let i = 0; i < 40 && !set; i++) { + await vent(250); + set = JSON.parse(execFileSync(H, ['find', '--app', 'com.google.Chrome', '--contains', `${M}-TITEL`, '--depth', '6'], + { encoding: 'utf8', env: { ...process.env, CMCP_INGEN_ELECTRON: '1' } })).count > 0; + } + check('0. test-vinduet er aabnet', set, 'Chrome viste ikke vinduet paa 10 s'); + await kl.connect(tr); + + const f1 = await kald('computer_find', { app: 'com.google.Chrome', contains: `${M}-FELT`, depth: 60 }); + check('1. serverens foerste find paa den ubyggede side svarer tree_building', + f1.json?.count === 0 && f1.json?.tree_building === true, f1.tekst.slice(0, 200)); + + let f2 = { json: { count: 0 } }; + for (let i = 0; i < 60 && !f2.json?.count; i++) { await vent(500); f2 = await kald('computer_find', { app: 'com.google.Chrome', contains: `${M}-FELT`, depth: 60 }); } + check('2. siden ses gennem serveren', f2.json?.count > 0 && f2.json.matches.some((m) => m.role === 'AXTextArea'), f2.tekst.slice(0, 200)); + + // ⛔ MAALT 5/11 kl. 06.47: arbejder personen i SIT Chrome, venter serverens vagt 40 s og skriver intet - + // vagten skelner paa program-id, og test-vinduet er ogsaa com.google.Chrome. Det er produktets + // adfaerd, ikke en fejl: proeven siger UMAALT for skrivningen, ikke DUMPET. + const venter = (r) => /^Waiting:/.test(r.tekst); + const s3 = await kald('computer_set_value', { app: 'com.google.Chrome', contains: `${M}-FELT`, role: 'AXTextArea', text: 'skrevet gennem serveren' }); + if (venter(s3)) console.log('UMAALT 3. skrivning gennem serveren - personen arbejder i Chrome, vagten venter (som den skal)'); + else check('3. computer_set_value skriver i tekstfeltet, verified', !s3.fejl && /verified/.test(s3.tekst), s3.tekst.slice(0, 200)); + + const s4 = venter(s3) ? s3 : await kald('computer_set_value', { app: 'com.google.Chrome', contains: `${M}-KODE`, subrole: 'AXSecureTextField', text: 'maa-aldrig-lande' }); + if (venter(s4)) console.log('UMAALT 4. afslag paa kodefeltet gennem serveren - samme grund'); + else check('4. computer_set_value paa kodefeltet naegtes', s4.fejl && /secure/i.test(s4.tekst), s4.tekst.slice(0, 200)); +} finally { + try { await kl.close(); } catch {} + ryd(); +} +console.log(fejl ? `\n${fejl} DUMPET` : '\nBESTAAET'); +process.exit(fejl ? 1 : 0); From bc3386283e2f38c8a09e3aa2d97adecbf1b00f86 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Thu, 5 Nov 2026 06:54:27 +0100 Subject: [PATCH 39/94] Skaermbilledet siger hvorfor et vindue er svaertet helt, og Chrome-proeverne er i suiten R1 (Opus) 5/11: hjaelperen giver redaction_note (tidsloft, eller en Chrome-side der stadig bygges), men serveren tabte den - 0 traeffere i mcp-server/. Agenten saa et sort vindue uden grund. Nu ordret videre. test/redaction-note.mjs: attrap-hjaelper, intet fotograferes; begge veje mutationsbevist (fjernet -> 1 roed, ubetinget -> 2 roed). De fire nye proever koerer i run-all.sh. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 10 ++++--- mcp-server/index.js | 3 +++ test/redaction-note.mjs | 58 +++++++++++++++++++++++++++++++++++++++++ test/run-all.sh | 6 +++++ 4 files changed, 74 insertions(+), 3 deletions(-) create mode 100644 test/redaction-note.mjs diff --git a/CHANGELOG.md b/CHANGELOG.md index 463a93b2..2ad49687 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -16,14 +16,18 @@ writing into a page's text field verified; writing into the password field refus (`secure-field`); the redaction scan of a heavy everyday Chrome took 0.14 to 0.54 s. Chrome builds the page in the background, 3 to 15 seconds after it is first switched on. While a Chrome window's page is not readable - still building, or empty - a search -that finds nothing says `tree_building`, and screenshots black that window out whole. +that finds nothing says `tree_building`, and screenshots black that window out whole - +and now say why: the helper's `redaction_note` reaches the agent instead of being +dropped by the server (`test/redaction-note.mjs`, both directions mutation-proven). Costs and changes, written in the README: Chrome keeps full accessibility mode until it quits; its windows may animate when moved (not measured); password managers that run inside Chrome can be read as text; `CMCP_INGEN_ELECTRON=1` leaves Chrome off too. Only Google Chrome is measured. Tests: `test/chrome-side-live.mjs` (against a real Chrome; four mutants - no blackout, web area always "built", Chrome never recognised, -`tree_building` off - each turn it red) and `test/claims-offline.mjs` 8b-8e (that the -code and the shipped binary carry the switch). +`tree_building` off - each turn it red), `test/chrome-dyb-side-live.mjs` (a password +field deeper than the scan reaches blacks the window out), `test/chrome-mcp-live.mjs` +(the same through the MCP server; red on a helper without the switch) and +`test/claims-offline.mjs` 8b-8f (that the code and the shipped binary carry the switch). **The screen without a question, if you want it.** Set `CMCP_SCREEN_ASK=0` and an agent that needs the screen borrows it with no question and no Touch ID - at once, or diff --git a/mcp-server/index.js b/mcp-server/index.js index bfa9abab..d008acc0 100644 --- a/mcp-server/index.js +++ b/mcp-server/index.js @@ -1196,6 +1196,9 @@ async function runTool(name, args) { ? ` and then add (${r.displayOriginX}, ${r.displayOriginY}) - that is where this screen starts on the desktop. ` : ' before you click. ') + `${r.redacted ? `Redacted (${r.redactedRegions} regions)` : 'NOT redacted'}. Scope: ${r.scope}.` + + // ⛔ R1 5/11 (Opus): hjaelperen siger HVORFOR et vindue er svaertet helt (tidsloft, eller en Chrome-side + // der stadig bygges) - serveren tabte det, og agenten saa et sort vindue uden grund. Ordret videre. + (typeof r.redaction_note === 'string' && r.redaction_note ? ` ${r.redaction_note}` : '') + // Kun naar der ER flere. En maskine med een skaerm skal ikke laese om et problem // den ikke har - men paa en maskine med tre var to af dem usynlige uden et ord. (r.displays > 1 diff --git a/test/redaction-note.mjs b/test/redaction-note.mjs new file mode 100644 index 00000000..718c899a --- /dev/null +++ b/test/redaction-note.mjs @@ -0,0 +1,58 @@ +// Naar et vindue er svaertet HELT, skal agenten faa at vide hvorfor. +// +// ⛔ R1 5/11 (Opus): hjaelperen giver `redaction_note` (tidsloftet ramt, eller en Chrome-side der stadig +// bygges), men serveren tabte den - 0 traeffere i mcp-server/. Agenten saa «Redacted (N regions)» og et +// sort Chrome-vindue uden grund, og konkluderede at Chrome var i stykker. +// +// En attrap-hjaelper leverer et 1x1-billede (som claims 17), saa intet fotograferes. Offline, ingen mus. +import { mkdtempSync, writeFileSync, chmodSync, rmSync } from 'node:fs'; +import { tmpdir } from 'node:os'; +import { join, dirname } from 'node:path'; +import { fileURLToPath } from 'node:url'; + +const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..'); +let fejl = 0; +const check = (navn, ok, hvorfor) => { console.log(`${ok ? 'OK ' : 'DUMP'} ${navn}${ok ? '' : ' - ' + hvorfor}`); if (!ok) fejl++; }; + +const NOTE = 'The redaction scan ran out of time in Google Chrome (its page content was still being built), so the WHOLE window was blacked out.'; +const dir = mkdtempSync(join(tmpdir(), 'cmcp-note-')); +const lavStub = (navn, ekstra) => { + const sti = join(dir, navn); + writeFileSync(sti, `#!/bin/sh +OUT=""; prev=""; for a in "$@"; do [ "$prev" = "--out" ] && OUT="$a"; prev="$a"; done +case "$1" in + screenshot) echo 'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNkYAAAAAYAAjCB0C8AAAAASUVORK5CYII=' | base64 -D > "$OUT" + echo '{"ok":true,"width":1,"height":1,"pixelsPerPoint":1,"screenWidthPoints":1,"screenHeightPoints":1,"redacted":true,"redactedRegions":1,"scope":"screen"${ekstra}}' ;; + apps) echo '{"ok":true,"apps":[]}' ;; + *) echo '{"ok":true}' ;; +esac +`); + chmodSync(sti, 0o755); + return sti; +}; + +const { Client } = await import(join(ROOT, 'mcp-server', 'node_modules', '@modelcontextprotocol', 'sdk', 'dist', 'esm', 'client', 'index.js')); +const { StdioClientTransport } = await import(join(ROOT, 'mcp-server', 'node_modules', '@modelcontextprotocol', 'sdk', 'dist', 'esm', 'client', 'stdio.js')); +const skaermTekst = async (helper) => { + const env = { ...process.env, CMCP_HELPER: helper, CMCP_STATE_DIR: join(dir, 'state-' + Math.random().toString(36).slice(2)), + CMCP_STATUS_IKON: '0', CMCP_MODE: 'readonly' }; + delete env.CMCP_BACKGROUND; + const kl = new Client({ name: 'redaction-note', version: '1' }); + await kl.connect(new StdioClientTransport({ command: process.execPath, args: [join(ROOT, 'mcp-server', 'index.js')], env, stderr: 'ignore' })); + try { + const r = await kl.callTool({ name: 'computer_screenshot', arguments: { maxWidth: 100 } }); + return { fejl: !!r.isError, tekst: (r.content || []).filter((c) => c.type === 'text').map((c) => c.text).join('\n') }; + } finally { await kl.close(); } +}; + +try { + const med = await skaermTekst(lavStub('med.sh', `,"redaction_note":${JSON.stringify(NOTE)},"redaction_whole_window":["Google Chrome"]`)); + check('1. hjaelperens note naar frem til agenten, ordret', !med.fejl && med.tekst.includes(NOTE), med.tekst.slice(0, 240)); + const uden = await skaermTekst(lavStub('uden.sh', '')); + check('2. uden note: intet ekstra (ingen «undefined», ingen tom saetning)', + !uden.fejl && /Redacted \(1 regions\)\. Scope: screen\./.test(uden.tekst) && !/undefined|null/.test(uden.tekst), uden.tekst.slice(0, 240)); +} finally { + try { rmSync(dir, { recursive: true, force: true }); } catch {} +} +console.log(fejl ? `\n${fejl} DUMPET` : '\nBESTAAET'); +process.exit(fejl ? 1 : 0); diff --git a/test/run-all.sh b/test/run-all.sh index b42f62f7..24575649 100755 --- a/test/run-all.sh +++ b/test/run-all.sh @@ -134,6 +134,12 @@ run "skriv ankommer" "node test/skriv-ankommer.mjs" run "baggrund mus" "node test/baggrund-mus.mjs" run "billede placering" "node test/billede-placering.mjs" run "web bagved" "node test/web-bagved.mjs" +# ⛔ 5/11: Chrome-sider ses og deres kodefelter svaertes (Chromes egen kontakt). Adfaerd mod en rigtig Chrome, +# fordi 8b-8e (tekst i kilden) lod 7 af 8 mutationer staa groenne. Siger selv UMAALT uden Chrome eller med laast skaerm. +run "chrome-sider" "node test/chrome-side-live.mjs" +run "chrome dyb side" "node test/chrome-dyb-side-live.mjs" +run "chrome via server" "node test/chrome-mcp-live.mjs" +run "sloeringens grund" "node test/redaction-note.mjs" run "menuvagt" "node test/menu-vagt.mjs" run "genaabn" "node test/genaabn.mjs" run "laeringsfilen" "node test/laering.mjs" From 98a2f62c5047dc249ece4699aca289434cc29be1 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Thu, 5 Nov 2026 07:14:19 +0100 Subject: [PATCH 40/94] Efter R2 (Astra, IKKE GODKENDT): porten kraever en fuldstaendig soegning, og noten siger den rigtige grund MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Efterproevet foer rettet: - F1: harWebIndhold saa kun niveau 0-11; et bygget panel kunne fritage en tom hovedside laengere nede. Nu skal soegningen naa til ende (16 niveauer), ingen opslag maa loebe toer undervejs, og fristen tjekkes efter sidste opslag. - F5: basislinjen for langsomme opslag blev sat EFTER portens egen soegning. Nu foer. - chromeSideUlaeselig kasserede et fejlet vinduesopslag og sprang ulaeselige rammer over: nu «ikke laesbar», som porten. - Ramme/underrolle-opslaget betales kun af Chromium, ikke af alle programmer. - Noten indledte enhver grund med «ran out of time»; nu baerer hver post sin egen, og dybde og tidsudloeb er to grunde. secure-rects giver grundene (whole_window). - Proever: dybdeproeven kraever feltet UNDER 40 og dybde-grunden; serverproeven kraever verified=true og tilbagelaesning, og ventekaldet har en frist. - README/npm-README/llms.txt: skaermbilledet siger nu hvorfor; Chrome-undtagelserne staar ogsaa i llms.txt. Co-Authored-By: Claude Opus 5.5 --- README.md | 5 +- docs/llms.txt | 6 +++ .../Sources/cmcp-helper/Accessibility.swift | 48 ++++++++++++++----- helper/Sources/cmcp-helper/Capture.swift | 2 +- helper/Sources/cmcp-helper/main.swift | 3 +- mcp-server/README.md | 5 +- test/chrome-dyb-side-live.mjs | 13 +++-- test/chrome-mcp-live.mjs | 10 +++- test/claims-offline.mjs | 4 +- test/redaction-note.mjs | 2 +- 10 files changed, 72 insertions(+), 26 deletions(-) diff --git a/README.md b/README.md index 814dde32..3b01c01b 100644 --- a/README.md +++ b/README.md @@ -49,8 +49,9 @@ draws its own controls on a canvas and publishes nothing - some games, some plotting tools - is still a blind spot. **In a browser,** Chrome builds a page's tree in the background the first time it is switched on, which took 3 to 15 seconds in our measurements; until then a search that finds nothing says -`tree_building`, and that Chrome window is blacked out whole in screenshots -(the screenshot only says how many regions were blacked out, not why). Only +`tree_building`, and that Chrome window is blacked out whole in screenshots, +with the reason in the answer. A page the scan cannot finish - deeper than it +reaches, or a lookup that timed out - is blacked out whole the same way. Only Google Chrome is measured. Other Chromium browsers than the ones named above - Chrome app windows (PWAs) included - are not switched on and not covered, and Safari and Firefox are not handled. When a browser tool is in the session, let diff --git a/docs/llms.txt b/docs/llms.txt index c3f37e0e..f438223d 100644 --- a/docs/llms.txt +++ b/docs/llms.txt @@ -110,6 +110,12 @@ under a friendlier name. - macOS only. - Only what macOS marks as secure is redacted. A password in a plain text editor or a token in a terminal buffer is not marked and will not be hidden. +- Chrome pages: only Google Chrome is measured; Chrome app windows (PWAs) and + unnamed Chromium browsers are not covered. A login inside a cross-site iframe + can be missing from the tree while it shows. Password managers that run inside + Chrome (extension popups, web vaults, Chrome's own password page) can be read + as text. CMCP_INGEN_ELECTRON=1 switches Chrome pages off too, and then their + password fields are not blacked out. - Consent is not containment; after approval the agent drives the real Mac. For containment, use a virtual machine. - Prompt injection stays possible; the dialogs and log make it visible, not diff --git a/helper/Sources/cmcp-helper/Accessibility.swift b/helper/Sources/cmcp-helper/Accessibility.swift index ecf20668..a7e7dc51 100644 --- a/helper/Sources/cmcp-helper/Accessibility.swift +++ b/helper/Sources/cmcp-helper/Accessibility.swift @@ -136,19 +136,28 @@ enum AX { // Et sidepanel eller en dokket DevTools er sit eget web-indhold og kan vaere bygget foer // siden - saa slap vinduet gennem porten med en ubygget side. Nu skal ALLE web-omraader // paa topniveau have indhold (de indlejrede - iframes - gaar vi ikke ned i). + // ⛔ R2 5/11 (Astra, LÆST og efterprøvet): løkken så kun niveau 0-11. Lå et bygget panel i dybde 8 og + // en TOM hovedside i dybde 12, godkendtes vinduet på panelet alene. Og et opslag der løb tør for tid + // (`children` tomt i stilhed) skjulte en gren. Nu kræves en FULDSTÆNDIG søgning: når den ikke til + // ende inden for dybden, eller løb et opslag tør undervejs, kan vi ikke stå inde for vinduet. + // Og fristen tjekkes EFTER sidste opslag, så et sent svar ikke godkendes. + let langsommeFoer = langsommeOpslag var lag = [win] var omraader: [AXUIElement] = [] - for _ in 0..<12 { + var fuldstaendig = false + for _ in 0..<16 { var naeste: [AXUIElement] = [] for el in lag { if Date() > frist { return false } if string(el, kAXRoleAttribute as String) == "AXWebArea" { omraader.append(el); continue } naeste.append(contentsOf: children(el)) } - if naeste.isEmpty { break } + if naeste.isEmpty { fuldstaendig = true; break } lag = naeste } - return !omraader.isEmpty && omraader.allSatisfy { Date() <= frist && !children($0).isEmpty } + guard fuldstaendig, !omraader.isEmpty else { return false } + let alleHarIndhold = omraader.allSatisfy { !children($0).isEmpty } + return alleHarIndhold && Date() <= frist && langsommeOpslag == langsommeFoer } @@ -162,11 +171,17 @@ enum AX { let frist = Date().addingTimeInterval(3) for app in allApps() where erChromium(app.bundleIdentifier) { if let s = scope, !passer(app, s) { continue } - for win in windowsMed(of: app).vinduer { + // ⛔ R2 5/11 (Astra): `.fejl` blev kasseret - et vinduesopslag der ikke fik svar, gav en tom liste, + // fristen blev aldrig tjekket, og svaret var «alt læsbart». Samme regel som porten: ved ingen + // svar kan vi ikke stå inde for siden. Og en ulæselig ramme/underrolle er et sidevindue (F2). + let opslag = windowsMed(of: app) + if opslag.fejl != nil { return true } + for win in opslag.vinduer { if Date() > frist { return true } - guard let vf = frame(win), vf.w >= 200, vf.h >= 120, - string(win, kAXSubroleAttribute as String) == "AXStandardWindow" else { continue } - if !harWebIndhold(win, frist: frist) { return true } + let vf = frame(win), vsub = string(win, kAXSubroleAttribute as String) + let sidevindue = vf == nil || vsub == nil + || (vsub == "AXStandardWindow" && vf!.w >= 200 && vf!.h >= 120) + if sidevindue, !harWebIndhold(win, frist: frist) { return true } } } return false @@ -788,7 +803,8 @@ enum AX { // `sloeringStoppede` paastod at vinduet var svaertet. let hele = frame(win).map { [$0] } ?? cgRammer(pid: app.processIdentifier) out.append(contentsOf: hele.isEmpty ? [indenfor ?? heleSkaermen()] : hele) - sloeringStoppede.append(app.localizedName ?? bid) + // R2 (Astra): noten sagde «ran out of time» om ALLE grunde - nu baerer hver post sin egen. + sloeringStoppede.append((app.localizedName ?? bid) + " (the scan ran out of time)") continue } // ⛔ MAALT 4/11: Chrome har ogsaa titelloese hjaelpe-vinduer (fanelinje og @@ -800,9 +816,16 @@ enum AX { // behandles vinduet som et sidevindue. Og Chromes egne bobler (adresse-forslag, gem-kodeord, // tilladelser) er ikke AXStandardWindow; de har aldrig et web-omraade og blev svaertet i // hvert billede med en falsk note. De gennemgaas nu som foer. - let vf = frame(win), vsub = string(win, kAXSubroleAttribute as String) - let sidevindue = vf == nil || vsub == nil - || (vsub == "AXStandardWindow" && vf!.w >= 200 && vf!.h >= 120) + // ⛔ R2 5/11 (Astra, LÆST og efterprøvet): basislinjen for F5 blev sat EFTER portens egen + // søgning, så et opslag der løb tør under porten, aldrig talte. Nu før - for hvert vindue. + let langsommeFoer = langsommeOpslag + // Kun Chromium betaler for ramme- og underrolle-opslaget (R2, Astra: før gjaldt det alle programmer). + var sidevindue = false + if erChromium { + let vf = frame(win), vsub = string(win, kAXSubroleAttribute as String) + sidevindue = vf == nil || vsub == nil + || (vsub == "AXStandardWindow" && vf!.w >= 200 && vf!.h >= 120) + } if erChromium, sidevindue, !AX.harWebIndhold(win, frist: start.addingTimeInterval(tidsgraense)) { let hele = frame(win).map { [$0] } ?? cgRammer(pid: app.processIdentifier) out.append(contentsOf: hele.isEmpty ? [indenfor ?? heleSkaermen()] : hele) @@ -835,7 +858,6 @@ enum AX { gennemgangFrist = start.addingTimeInterval(tidsgraense) gennemgangOverskred = false dybdeRamt = false - let langsommeFoer = langsommeOpslag walk(win, depth: 0, maxDepth: maxDepth) { el, role in if isSecure(el, role: role), let f = frame(el) { out.append(f) } } @@ -847,7 +869,7 @@ enum AX { if erChromium && !gennemgangOverskred && (dybdeRamt || langsommeOpslag > langsommeFoer) { let hele = frame(win).map { [$0] } ?? cgRammer(pid: app.processIdentifier) out.append(contentsOf: hele.isEmpty ? [indenfor ?? heleSkaermen()] : hele) - sloeringStoppede.append((app.localizedName ?? bid) + " (its page went deeper than the scan reaches, or a lookup timed out - window blacked out whole)") + sloeringStoppede.append((app.localizedName ?? bid) + (dybdeRamt ? " (its page went deeper than the scan reaches - window blacked out whole)" : " (a lookup in its page timed out - window blacked out whole)")) continue } if gennemgangOverskred { diff --git a/helper/Sources/cmcp-helper/Capture.swift b/helper/Sources/cmcp-helper/Capture.swift index 76b64cc8..362b2501 100644 --- a/helper/Sources/cmcp-helper/Capture.swift +++ b/helper/Sources/cmcp-helper/Capture.swift @@ -328,7 +328,7 @@ enum Capture { "displayIndex": box.displayIndex, "displayId": box.displayId, "redaction_whole_window": ufuldstaendig.isEmpty ? nil : Array(Set(ufuldstaendig)) as Any, - "redaction_note": ufuldstaendig.isEmpty ? nil : "The redaction scan ran out of time in \(Set(ufuldstaendig).joined(separator: ", ")), so the WHOLE window was blacked out rather than risk leaving a password field visible. Screenshot one app instead, or a display those windows are not on." as Any, + "redaction_note": ufuldstaendig.isEmpty ? nil : "The redaction scan could not vouch for every password field in: \(Set(ufuldstaendig).sorted().joined(separator: "; ")). Those windows were blacked out WHOLE rather than risk leaving a password field visible. Screenshot one app instead, or a display those windows are not on; a Chrome page still being built is readable a few seconds later." as Any, "displayOriginX": Int(box.origin.x), "displayOriginY": Int(box.origin.y), "redacted": redact, diff --git a/helper/Sources/cmcp-helper/main.swift b/helper/Sources/cmcp-helper/main.swift index c49db725..42c95aab 100644 --- a/helper/Sources/cmcp-helper/main.swift +++ b/helper/Sources/cmcp-helper/main.swift @@ -182,7 +182,8 @@ case "activate": case "secure-rects": Perms.require(accessibility: true) let rects = AX.secureRects(scopeBundleId: args.str("app"), extraDeny: denySet(args)) - Out.ok(["rects": rects.map(\.dict), "count": rects.count]) + // R2 5/11: HVORFOR et vindue blev svaertet helt - saa en proeve kan kraeve den rigtige grund, ikke bare et rektangel. + Out.ok(["rects": rects.map(\.dict), "count": rects.count, "whole_window": AX.sloeringStoppede]) case "screenshot": // ⛔ 24/9: et ukendt flag paa DENNE kommando skal afvises, ikke ignoreres. diff --git a/mcp-server/README.md b/mcp-server/README.md index 561a270f..932f54f6 100644 --- a/mcp-server/README.md +++ b/mcp-server/README.md @@ -47,8 +47,9 @@ draws its own controls on a canvas and publishes nothing - some games, some plotting tools - is still a blind spot. **In a browser,** Chrome builds a page's tree in the background the first time it is switched on, which took 3 to 15 seconds in our measurements; until then a search that finds nothing says -`tree_building`, and that Chrome window is blacked out whole in screenshots -(the screenshot only says how many regions were blacked out, not why). Only +`tree_building`, and that Chrome window is blacked out whole in screenshots, +with the reason in the answer. A page the scan cannot finish - deeper than it +reaches, or a lookup that timed out - is blacked out whole the same way. Only Google Chrome is measured. Other Chromium browsers than the ones named above - Chrome app windows (PWAs) included - are not switched on and not covered, and Safari and Firefox are not handled. When a browser tool is in the session, let diff --git a/test/chrome-dyb-side-live.mjs b/test/chrome-dyb-side-live.mjs index 0679e68f..8d40d9a1 100644 --- a/test/chrome-dyb-side-live.mjs +++ b/test/chrome-dyb-side-live.mjs @@ -76,9 +76,16 @@ try { for (let i = 0; i < 60 && !f.count; i++) { await vent(500); f = hj(['find', '--app', 'com.google.Chrome', '--contains', 'CMCPLIVEFELT', '--depth', '60']); } check('1. siden er bygget (tekstfeltet ses)', f.count > 0, 'ikke fundet paa 30 s'); const dyb = hj(['find', '--app', 'com.google.Chrome', '--contains', 'CMCPLIVEKODE', '--depth', '80']); - check('2. kodefeltet ligger dybere end sloeringens 40 (fundet med dybde 80)', dyb.count > 0, 'Chrome viser ikke de indlejrede grupper som lag'); - const r = hj(['secure-rects', '--app', 'com.google.Chrome']).rects.filter(iVinduet); - check('3. et felt sloeringen ikke naar, svaerter HELE vinduet', r.some(heleVinduet), `kun ${JSON.stringify(r)}`); + // ⛔ R2 (Astra): «fundet med 80» beviste ikke at feltet ligger DYBERE end 40. Nu begge sider af loftet. + const flad = hj(['find', '--app', 'com.google.Chrome', '--contains', 'CMCPLIVEKODE', '--depth', '40']); + check('2. kodefeltet ligger dybere end sloeringens 40 (ikke fundet med 40, fundet med 80)', dyb.count > 0 && flad.count === 0, + `dybde 40: ${flad.count}, dybde 80: ${dyb.count}`); + const sr = hj(['secure-rects', '--app', 'com.google.Chrome']); + const r = sr.rects.filter(iVinduet); + // ⛔ R2 (Astra): et hele-vindue-rektangel kan have en ANDEN grund. Kraev dybde-grunden. + check('3. et felt sloeringen ikke naar, svaerter HELE vinduet - af netop den grund', + r.some(heleVinduet) && (sr.whole_window || []).some((g) => /deeper than the scan reaches/.test(g)), + `rekt ${JSON.stringify(r)} grunde ${JSON.stringify(sr.whole_window)}`); } finally { ryd(); } diff --git a/test/chrome-mcp-live.mjs b/test/chrome-mcp-live.mjs index b37990ec..2052b3ec 100644 --- a/test/chrome-mcp-live.mjs +++ b/test/chrome-mcp-live.mjs @@ -69,7 +69,7 @@ try { for (let i = 0; i < 40 && !set; i++) { await vent(250); set = JSON.parse(execFileSync(H, ['find', '--app', 'com.google.Chrome', '--contains', `${M}-TITEL`, '--depth', '6'], - { encoding: 'utf8', env: { ...process.env, CMCP_INGEN_ELECTRON: '1' } })).count > 0; + { encoding: 'utf8', timeout: 15000, env: { ...process.env, CMCP_INGEN_ELECTRON: '1' } })).count > 0; } check('0. test-vinduet er aabnet', set, 'Chrome viste ikke vinduet paa 10 s'); await kl.connect(tr); @@ -88,7 +88,13 @@ try { const venter = (r) => /^Waiting:/.test(r.tekst); const s3 = await kald('computer_set_value', { app: 'com.google.Chrome', contains: `${M}-FELT`, role: 'AXTextArea', text: 'skrevet gennem serveren' }); if (venter(s3)) console.log('UMAALT 3. skrivning gennem serveren - personen arbejder i Chrome, vagten venter (som den skal)'); - else check('3. computer_set_value skriver i tekstfeltet, verified', !s3.fejl && /verified/.test(s3.tekst), s3.tekst.slice(0, 200)); + else { + // ⛔ R2 (Astra, MAALT): /verified/ matchede ogsaa «"verified":false». Kraev sand vaerdi OG tilbagelaesning. + const tilbage = await kald('computer_find', { app: 'com.google.Chrome', contains: `${M}-FELT`, role: 'AXTextArea', depth: 60 }); + check('3. computer_set_value skriver i tekstfeltet, verified og laest tilbage', + !s3.fejl && s3.json?.verified === true && JSON.stringify(tilbage.json?.matches?.[0]?.names || []).includes('skrevet gennem serveren'), + s3.tekst.slice(0, 200)); + } const s4 = venter(s3) ? s3 : await kald('computer_set_value', { app: 'com.google.Chrome', contains: `${M}-KODE`, subrole: 'AXSecureTextField', text: 'maa-aldrig-lande' }); if (venter(s4)) console.log('UMAALT 4. afslag paa kodefeltet gennem serveren - samme grund'); diff --git a/test/claims-offline.mjs b/test/claims-offline.mjs index 2609cddd..75575957 100644 --- a/test/claims-offline.mjs +++ b/test/claims-offline.mjs @@ -154,7 +154,9 @@ check('focused siger det ogsaa', /\(AX\.chromeTaendtNu \|\| AX\.chromeSideUlaese 'computer_type afviser med focus-unknown uden at sige hvorfor'); // 8d. ⛔ MAALT 5/11: web-omraadet ligger i DYBDE 8. Foerste udgave af harWebIndhold soegte 6 // niveauer, fandt det aldrig, og svaertede derfor ALLE Chrome-vinduer i hvert billede. -const hw = sw.slice(sw.indexOf('static func harWebIndhold'), sw.indexOf('static func harWebIndhold') + 900); +// Hele funktionen (til naeste `static func`), ikke de foerste 900 tegn: en kommentar skubbede loekken ud (R2 5/11). +const hwStart = sw.indexOf('static func harWebIndhold'); +const hw = sw.slice(hwStart, sw.indexOf('static func', hwStart + 10)); const niv = Number((hw.match(/for _ in 0\.\.<(\d+)/) || [])[1] || 0); check('harWebIndhold soeger dybere end web-omraadet (dybde 8)', niv >= 9, `soeger ${niv} niveauer`); // 8e. Chromes titelloese hjaelpe-vinduer (41-47 pkt hoeje strimler) har aldrig et web-omraade. diff --git a/test/redaction-note.mjs b/test/redaction-note.mjs index 718c899a..6809cb04 100644 --- a/test/redaction-note.mjs +++ b/test/redaction-note.mjs @@ -14,7 +14,7 @@ const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..'); let fejl = 0; const check = (navn, ok, hvorfor) => { console.log(`${ok ? 'OK ' : 'DUMP'} ${navn}${ok ? '' : ' - ' + hvorfor}`); if (!ok) fejl++; }; -const NOTE = 'The redaction scan ran out of time in Google Chrome (its page content was still being built), so the WHOLE window was blacked out.'; +const NOTE = 'The redaction scan could not vouch for every password field in: Google Chrome (its page was not readable yet - still being built, or empty - so the window was blacked out whole). Those windows were blacked out WHOLE rather than risk leaving a password field visible.'; const dir = mkdtempSync(join(tmpdir(), 'cmcp-note-')); const lavStub = (navn, ekstra) => { const sti = join(dir, navn); From 143e699330b94b81ccd69b7f3f3d5f8b58fb3155 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Thu, 5 Nov 2026 07:38:00 +0100 Subject: [PATCH 41/94] Efter R2 (Opus, GODKENDT MED RETTELSER): popups og fejlkoder lukker porten, og chats kan se hvilken hjaelper de koerer MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - N2: Chrome-reglerne taeller nu ogsaa .invalidUIElement og .failure (ny taeller uvisseOpslag); foer var kun tidsudloeb talt, og de andre gav tomme svar i stilhed. - N3: en udvidelses-popup sprang porten over (ikke AXStandardWindow). Nu: ethvert vindue med et web-omraade kraever indhold, og kaldet der taender Chrome svaerter alle dets vinduer. Chromes egne bobler har intet web-omraade og gennemgaas som foer. - N4: erChromium paa segmenter (helper/framework/app udelukket, chromeremotedesktop ude). - N5: fristen tjekkes ogsaa mellem programmer. N6: noterne laegges sammen i find. - N7: inspect faar tree_building. N11: version siger chrome-page-redaction (over 15 tegn, ellers ser claims-offline den ikke - kalibreret: ny 1, 23/10-binaeren 0). - N8: kapabilitetssiden sagde stadig «you get the browser window, not the page». - N1: Chrome-proeverne skriver husets SPRUNGET OVER-linje ved laast skaerm. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 9 ++++ docs/docs/capability-matrix/index.html | 2 +- .../Sources/cmcp-helper/Accessibility.swift | 54 ++++++++++++++++--- helper/Sources/cmcp-helper/main.swift | 14 ++++- test/chrome-dyb-side-live.mjs | 4 +- test/chrome-mcp-live.mjs | 8 +-- test/chrome-side-live.mjs | 4 +- test/claims-offline.mjs | 3 ++ 8 files changed, 80 insertions(+), 18 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2ad49687..f99d73ef 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -28,6 +28,15 @@ Chrome; four mutants - no blackout, web area always "built", Chrome never recogn field deeper than the scan reaches blacks the window out), `test/chrome-mcp-live.mjs` (the same through the MCP server; red on a helper without the switch) and `test/claims-offline.mjs` 8b-8f (that the code and the shipped binary carry the switch). +After a second review (two reviewers, 5 Nov) the gate fails closed in more places: a +Chrome window passes only when the search for its pages reached the end and no lookup +answered "don't know" (a timeout, an element Chrome rebuilt mid-scan, a failure); a +window with a web area needs content whatever its role, so an extension popup is +covered; and the call that switches Chrome on blacks out all of that Chrome's windows. +The screenshot note names each window's own reason, `secure-rects` returns them +(`whole_window`), and `version` lists `chrome-page-redaction`, so an agent can tell +which helper it runs. The Chrome tests say `SPRUNGET OVER` - proved nothing - when the +screen is locked, instead of passing. **The screen without a question, if you want it.** Set `CMCP_SCREEN_ASK=0` and an agent that needs the screen borrows it with no question and no Touch ID - at once, or diff --git a/docs/docs/capability-matrix/index.html b/docs/docs/capability-matrix/index.html index 5a709556..d41ddd8d 100644 --- a/docs/docs/capability-matrix/index.html +++ b/docs/docs/capability-matrix/index.html @@ -209,7 +209,7 @@

    Walls in macOS itself

WallWhat actually happens
Redacting secretsmeasuredOnly what macOS marks as secure is painted out. Measured on a real web page: a password input carries role AXTextField with subrole AXSecureTextField and is redacted; a plain text field is not. A password in a text editor, or a token printed in a terminal, carries no marker and will not be hidden. Use readonly when the screen holds something the system cannot know about.
Working without taking over the screenmeasuredThree kinds, and the difference is how the action is delivered, not what the tool is called. Quiet by delivery: computer_press, computer_set_value and computer_menu fire the element's own accessibility action, so they work on a window behind the one you are in and never touch your pointer. The app can still bring itself forward in response - measured: File > New Finder Window did - and then press and menu answer took_screen and hand the front straight back - gave_back says whether that worked (once in 65 moments on GitHub’s Mac it did not). Quiet when you name the app: computer_click, computer_type, computer_key and computer_scroll are delivered into that app's own event queue - measured: the text arrived, the pointer stayed where it was left, and the front window did not change. computer_launch joins them with background: true - measured on a clean Mac, six of eight apps brought themselves forward as they started, and the front is handed straight back. Without an app they go through the system input tap and land wherever your keyboard focus is, so in background mode they are refused. One measured limit: keystrokes do not land in a Chromium window that is not focused, so for anything Chromium-based use computer_press and computer_set_value. Held back in background mode: computer_move, computer_drag, computer_paste, computer_activate, computer_quit, computer_space and computer_window. Each either moves your pointer, brings something to the front, or changes what you see - a window moved on a screen you are looking at is a quiet channel with a very visible result. computer_ask_user left this list on 29 September: in background mode its question waits in the menu bar icon instead of a dialog. And the held-back seven are no longer out of reach: computer_request_screen asks you to lend this one agent the screen, approved with Touch ID in the menu bar, for at most 15 minutes. While it has it, each step waits while you are using the keyboard or mouse (a step already running finishes), and one click in the menu takes the screen back and stops a step still running. Set CMCP_BACKGROUND and nothing can borrow it.
Working without taking over the screenmeasuredThree kinds, and the difference is how the action is delivered, not what the tool is called. Quiet by delivery: computer_press, computer_set_value and computer_menu fire the element's own accessibility action, so they work on a window behind the one you are in and never touch your pointer. The app can still bring itself forward in response - measured: File > New Finder Window did - and then press and menu answer took_screen and hand the front straight back - gave_back says whether that worked (once in 65 moments on GitHub’s Mac it did not). Quiet when you name the app: computer_click, computer_type, computer_key and computer_scroll are delivered into that app's own event queue - measured: the text arrived, the pointer stayed where it was left, and the front window did not change. computer_launch joins them with background: true - measured on a clean Mac, six of eight apps brought themselves forward as they started, and the front is handed straight back - gave_back says whether that worked. Without an app they go through the system input tap and land wherever your keyboard focus is, so in background mode they are refused. One measured limit: keystrokes do not land in a Chromium window that is not focused, so for anything Chromium-based use computer_press and computer_set_value. Held back in background mode: computer_move, computer_drag, computer_paste, computer_activate, computer_quit, computer_space and computer_window. Each either moves your pointer, brings something to the front, or changes what you see - a window moved on a screen you are looking at is a quiet channel with a very visible result. computer_ask_user left this list on 29 September: in background mode its question waits in the menu bar icon instead of a dialog. And the held-back seven are no longer out of reach: computer_request_screen asks you to lend this one agent the screen, approved with Touch ID in the menu bar, for at most 15 minutes. While it has it, each step waits while you are using the keyboard or mouse (a step already running finishes), and one click in the menu takes the screen back and stops a step still running. Set CMCP_BACKGROUND and nothing can borrow it.
Several agents at oncemeasuredEach MCP client runs its own server. Measured: two servers, 50 interleaved writes, zero torn lines, and every line carries a session mark. Writes in the same app take turns: each holds a lock for that app, so keys and clicks never interleave within an action. Between actions they still share one pointer and one focused window; give background work to computer_press.
Knowing where the cursor ismeasuredcomputer_focused reports the focused element and whether it is secure. The system-wide lookup alone returns nothing - measured - so it goes through the focused application, then the frontmost app.
A Save / Don't Save sheetmeasuredThe sheet you meet every time you close something with unsaved work. Measured: the sheet is found as AXSheet, all three buttons come back with a center and a pressable flag, and computer_find with contains: "Don't Save" returns exactly that one button - an agent looks for the words, not for a position. It is also the clearest case for the gate: a sheet can throw away work on your behalf, so in read-only mode pressing it is refused and nothing reaches the machine. Measured against a sheet the test puts up itself, in a fully transparent window, so proving it costs nobody their screen.
- + diff --git a/helper/Sources/cmcp-helper/Accessibility.swift b/helper/Sources/cmcp-helper/Accessibility.swift index a7e7dc51..f78d5147 100644 --- a/helper/Sources/cmcp-helper/Accessibility.swift +++ b/helper/Sources/cmcp-helper/Accessibility.swift @@ -99,8 +99,13 @@ enum AX { static func erChromium(_ bundleId: String?) -> Bool { guard let id = bundleId else { return false } if chromiumBrowsere.contains(id) { return true } - let lav = id.lowercased() - return lav.hasPrefix("com.google.chrome") && !lav.contains(".app.") && !lav.hasSuffix(".helper") + // ⛔ R2 5/11 (Opus N4, MAALT i app-bundtet): som tekst-praefiks matchede reglen ogsaa + // `com.google.Chrome.helper.renderer` og `com.google.Chrome.framework.AlertNotificationService` - + // og `com.google.chromeremotedesktop` ville have passet. Nu paa SEGMENTER: de tre foerste skal vaere + // com.google.chrome, og intet senere segment maa vaere app (PWA-skaller), helper eller framework. + let seg = id.lowercased().split(separator: ".").map(String.init) + guard seg.count >= 3, Array(seg[0..<3]) == ["com", "google", "chrome"] else { return false } + return !seg.dropFirst(3).contains(where: { ["app", "helper", "framework"].contains($0) }) } static func taendTrae(_ pid: pid_t) { @@ -141,7 +146,7 @@ enum AX { // (`children` tomt i stilhed) skjulte en gren. Nu kræves en FULDSTÆNDIG søgning: når den ikke til // ende inden for dybden, eller løb et opslag tør undervejs, kan vi ikke stå inde for vinduet. // Og fristen tjekkes EFTER sidste opslag, så et sent svar ikke godkendes. - let langsommeFoer = langsommeOpslag + let uvisseFoer = uvisseOpslag var lag = [win] var omraader: [AXUIElement] = [] var fuldstaendig = false @@ -157,10 +162,29 @@ enum AX { } guard fuldstaendig, !omraader.isEmpty else { return false } let alleHarIndhold = omraader.allSatisfy { !children($0).isEmpty } - return alleHarIndhold && Date() <= frist && langsommeOpslag == langsommeFoer + return alleHarIndhold && Date() <= frist && uvisseOpslag == uvisseFoer } + /// Har vinduet et web-omraade overhovedet? Til de vinduer der IKKE er almindelige browser-vinduer + /// (bobler, udvidelses-popups). Kan vi ikke svare fuldt - dybden naaet, et opslag svarede «ved ikke», + /// fristen naaet - er svaret ja: saa skal porten kraeve indhold (R2, Opus N3). + static func harWebOmraade(_ win: AXUIElement, frist: Date) -> Bool { + let uvisseFoer = uvisseOpslag + var lag = [win] + for _ in 0..<16 { + var naeste: [AXUIElement] = [] + for el in lag { + if Date() > frist { return true } + if string(el, kAXRoleAttribute as String) == "AXWebArea" { return true } + naeste.append(contentsOf: children(el)) + } + if naeste.isEmpty { return uvisseOpslag != uvisseFoer } + lag = naeste + } + return true + } + /// Er der et Chrome-vindue med side-stoerrelse, hvis side ikke kan laeses endnu? /// ⛔ REVIEW 5/11 (Opus) + adfaerdsproeven: `tree_building` kom kun paa det ENE kald der vendte /// kontakten - og kun hvis det fik 0. Proevens foerste opslag (vinduets titel) vendte den, og @@ -170,6 +194,8 @@ enum AX { guard !taendTraeSlaaetFra else { return false } let frist = Date().addingTimeInterval(3) for app in allApps() where erChromium(app.bundleIdentifier) { + // R2 (Opus N5): fristen tjekkes ogsaa mellem programmer - et program uden vinduer naaede aldrig et tjek. + if Date() > frist { return true } if let s = scope, !passer(app, s) { continue } // ⛔ R2 5/11 (Astra): `.fejl` blev kasseret - et vinduesopslag der ikke fik svar, gav en tom liste, // fristen blev aldrig tjekket, og svaret var «alt læsbart». Samme regel som porten: ved ingen @@ -181,6 +207,7 @@ enum AX { let vf = frame(win), vsub = string(win, kAXSubroleAttribute as String) let sidevindue = vf == nil || vsub == nil || (vsub == "AXStandardWindow" && vf!.w >= 200 && vf!.h >= 120) + || harWebOmraade(win, frist: frist) // ogsaa en popup med en side (Opus N3) if sidevindue, !harWebIndhold(win, frist: frist) { return true } } } @@ -198,6 +225,8 @@ enum AX { /// ufuldstaendig laesning er ikke bedre end en langsom, hvis svaret ikke /// siger at noget mangler. Vi taeller de opslag der loeb toer for tid. static var langsommeOpslag = 0 + /// Opslag der svarede «ved ikke» (tidsudloeb, ugyldigt element, fejl). Chrome-reglerne bruger denne. + static var uvisseOpslag = 0 /// Hvor et gennemloeb starter i et program. EEN funktion for sloering, find og /// inspect - de tre stod som kopier, og en rettelse der kun ramte find, ville @@ -221,6 +250,10 @@ enum AX { var value: CFTypeRef? let fejl = AXUIElementCopyAttributeValue(el, name as CFString, &value) if fejl == .cannotComplete { langsommeOpslag += 1 } + // R2 5/11 (Opus N2): kun tidsudloeb blev talt. `.invalidUIElement` (Chrome genopbygger en gren midt i + // scanningen) og `.failure` gav ogsaa et tomt svar i stilhed. «Der er ingen vaerdi» (.noValue, + // .attributeUnsupported) er et svar; de tre her er «vi ved det ikke». + if fejl == .cannotComplete || fejl == .invalidUIElement || fejl == .failure { uvisseOpslag += 1 } guard fejl == .success else { return nil } return value } @@ -818,13 +851,20 @@ enum AX { // hvert billede med en falsk note. De gennemgaas nu som foer. // ⛔ R2 5/11 (Astra, LÆST og efterprøvet): basislinjen for F5 blev sat EFTER portens egen // søgning, så et opslag der løb tør under porten, aldrig talte. Nu før - for hvert vindue. - let langsommeFoer = langsommeOpslag + let uvisseFoer = uvisseOpslag // Kun Chromium betaler for ramme- og underrolle-opslaget (R2, Astra: før gjaldt det alle programmer). var sidevindue = false if erChromium { let vf = frame(win), vsub = string(win, kAXSubroleAttribute as String) + // ⛔ R2 5/11 (Opus N3): underrollen var en tilladelsesliste paa ét element. En udvidelses- + // popup (1Password, Bitwarden) er ikke AXStandardWindow - den har web-indhold og sprang + // porten over. Nu gaelder porten ogsaa (a) ethvert vindue, naar DETTE kald lige taendte + // Chromes trae (saa er intet bygget endnu), og (b) ethvert vindue der HAR et web-omraade. + // Chromes egne bobler har intet web-omraade og gennemgaas som foer. sidevindue = vf == nil || vsub == nil || (vsub == "AXStandardWindow" && vf!.w >= 200 && vf!.h >= 120) + || AX.chromeTaendtNu + || AX.harWebOmraade(win, frist: start.addingTimeInterval(tidsgraense)) } if erChromium, sidevindue, !AX.harWebIndhold(win, frist: start.addingTimeInterval(tidsgraense)) { let hele = frame(win).map { [$0] } ?? cgRammer(pid: app.processIdentifier) @@ -866,10 +906,10 @@ enum AX { // loftet (40), blev ikke fundet, og vinduet blev ikke svaertet: 0 rektangler. Et opslag der // loeb toer for tid giver ogsaa et tomt svar i stilhed. I Chrome-sider kan vi derfor ikke // staa inde for en gennemgang der ramte loftet eller tiden - hele vinduet ud. - if erChromium && !gennemgangOverskred && (dybdeRamt || langsommeOpslag > langsommeFoer) { + if erChromium && !gennemgangOverskred && (dybdeRamt || uvisseOpslag > uvisseFoer) { let hele = frame(win).map { [$0] } ?? cgRammer(pid: app.processIdentifier) out.append(contentsOf: hele.isEmpty ? [indenfor ?? heleSkaermen()] : hele) - sloeringStoppede.append((app.localizedName ?? bid) + (dybdeRamt ? " (its page went deeper than the scan reaches - window blacked out whole)" : " (a lookup in its page timed out - window blacked out whole)")) + sloeringStoppede.append((app.localizedName ?? bid) + (dybdeRamt ? " (its page went deeper than the scan reaches - window blacked out whole)" : " (a lookup in its page failed or timed out - window blacked out whole)")) continue } if gennemgangOverskred { diff --git a/helper/Sources/cmcp-helper/main.swift b/helper/Sources/cmcp-helper/main.swift index 42c95aab..f818a4a5 100644 --- a/helper/Sources/cmcp-helper/main.swift +++ b/helper/Sources/cmcp-helper/main.swift @@ -107,7 +107,11 @@ case "version", "--version", "-v": // og proeven tog et billede. Spoerg her, foer du kalder screenshot. Out.ok(["version": HELPER_VERSION, "capabilities": ["screenshot-plan", "screenshot-strict-flags", "capture-excludes-denied-apps", - "redaction-fails-closed", "resolve-app", "record"]]) + "redaction-fails-closed", "resolve-app", "record", + // R2 (Opus N11): gammel og ny hjaelper svarede ens - nu kan en chat maale hvilken den koerer. + // Over 15 tegn MED VILJE: Swift gemmer kortere strenge i koden, ikke i strengtabellen, + // og saa kan claims-offline ikke se den i binaeren. + "chrome-page-redaction"]]) case "permissions": Out.ok(Perms.report()) @@ -484,6 +488,11 @@ case "inspect": svar["stopped_early"] = true svar["note"] = "The walk stopped after \(Int(AX.tidsgraense)) seconds - this app answers slowly, so this is PART of the tree, not all of it. Narrow it with find, or a lower depth." } + // R2 (Opus N7): inspect havde intet signal for en Chrome-side der stadig bygges - samme som find. + if AX.chromeTaendtNu || AX.chromeSideUlaeselig(scope: args.str("app")) { + svar["tree_building"] = true + svar["note"] = [svar["note"] as? String, AX.chromeByggerNote].compactMap { $0 }.joined(separator: " ") + } Out.ok(svar) case "find": @@ -508,7 +517,8 @@ case "find": // ⛔ MAALT 4/11: kaldet der taendte Chromes web-trae, saa 0 - traeet kom 3-15 s senere. if hits.isEmpty && (AX.chromeTaendtNu || AX.chromeSideUlaeselig(scope: args.str("app"))) { fundSvar["tree_building"] = true - fundSvar["note"] = AX.chromeByggerNote + // R2 (Opus N6): noten overskrev stopped_early-noten, mens flaget blev staaende. Begge siges nu. + fundSvar["note"] = [fundSvar["note"] as? String, AX.chromeByggerNote].compactMap { $0 }.joined(separator: " ") } Out.ok(fundSvar) diff --git a/test/chrome-dyb-side-live.mjs b/test/chrome-dyb-side-live.mjs index 8d40d9a1..8adfc05b 100644 --- a/test/chrome-dyb-side-live.mjs +++ b/test/chrome-dyb-side-live.mjs @@ -32,13 +32,13 @@ import { fileURLToPath } from 'node:url'; const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..'); const H = process.env.CMCP_HELPER || join(ROOT, 'mcp-server', 'vendor', 'cmcp-helper'); const CHROME = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'; -if (!existsSync(CHROME)) { console.log('UMAALT Google Chrome er ikke installeret her'); process.exit(0); } +if (!existsSync(CHROME)) { console.log('SPRUNGET OVER: 4 (Google Chrome er ikke installeret her) - bevist intet, ikke bestaaet'); process.exit(0); } // ⛔ MAALT 5/11 kl. 02.09: mens Mac'en er LAAST, bygger Chrome ikke siders tilgaengeligheds-trae. // Et maaleprogram uden hjaelperen fandt 0 web-omraader efter 25,6 s paa en frisk Chrome (laast), // mod 2,1 s kl. 01.20 (ulaast). Proeven maaler da laasen, ikke koden - saa den siger UMAALT. { const io = execFileSync('ioreg', ['-n', 'Root', '-d1'], { encoding: 'utf8' }); - if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) { console.log('UMAALT skaermen er laast - Chrome bygger ingen sider imens'); process.exit(0); } + if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) { console.log('SPRUNGET OVER: 4 (skaermen er laast - Chrome bygger ingen sider imens) - bevist intet, ikke bestaaet'); process.exit(0); } } let fejl = 0; diff --git a/test/chrome-mcp-live.mjs b/test/chrome-mcp-live.mjs index 2052b3ec..97d898e9 100644 --- a/test/chrome-mcp-live.mjs +++ b/test/chrome-mcp-live.mjs @@ -22,10 +22,10 @@ import { fileURLToPath } from 'node:url'; const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..'); const H = process.env.CMCP_HELPER || join(ROOT, 'mcp-server', 'vendor', 'cmcp-helper'); const CHROME = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'; -if (!existsSync(CHROME)) { console.log('UMAALT Google Chrome er ikke installeret her'); process.exit(0); } +if (!existsSync(CHROME)) { console.log('SPRUNGET OVER: 5 (Google Chrome er ikke installeret her) - bevist intet, ikke bestaaet'); process.exit(0); } { const io = execFileSync('ioreg', ['-n', 'Root', '-d1'], { encoding: 'utf8' }); - if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) { console.log('UMAALT skaermen er laast - Chrome bygger ingen sider imens'); process.exit(0); } + if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) { console.log('SPRUNGET OVER: 5 (skaermen er laast - Chrome bygger ingen sider imens) - bevist intet, ikke bestaaet'); process.exit(0); } } let fejl = 0; @@ -87,7 +87,7 @@ try { // adfaerd, ikke en fejl: proeven siger UMAALT for skrivningen, ikke DUMPET. const venter = (r) => /^Waiting:/.test(r.tekst); const s3 = await kald('computer_set_value', { app: 'com.google.Chrome', contains: `${M}-FELT`, role: 'AXTextArea', text: 'skrevet gennem serveren' }); - if (venter(s3)) console.log('UMAALT 3. skrivning gennem serveren - personen arbejder i Chrome, vagten venter (som den skal)'); + if (venter(s3)) console.log('SPRUNGET OVER: 1 (3. skrivning gennem serveren: personen arbejder i Chrome, vagten venter som den skal) - bevist intet, ikke bestaaet'); else { // ⛔ R2 (Astra, MAALT): /verified/ matchede ogsaa «"verified":false». Kraev sand vaerdi OG tilbagelaesning. const tilbage = await kald('computer_find', { app: 'com.google.Chrome', contains: `${M}-FELT`, role: 'AXTextArea', depth: 60 }); @@ -97,7 +97,7 @@ try { } const s4 = venter(s3) ? s3 : await kald('computer_set_value', { app: 'com.google.Chrome', contains: `${M}-KODE`, subrole: 'AXSecureTextField', text: 'maa-aldrig-lande' }); - if (venter(s4)) console.log('UMAALT 4. afslag paa kodefeltet gennem serveren - samme grund'); + if (venter(s4)) console.log('SPRUNGET OVER: 1 (4. afslag paa kodefeltet gennem serveren: samme grund) - bevist intet, ikke bestaaet'); else check('4. computer_set_value paa kodefeltet naegtes', s4.fejl && /secure/i.test(s4.tekst), s4.tekst.slice(0, 200)); } finally { try { await kl.close(); } catch {} diff --git a/test/chrome-side-live.mjs b/test/chrome-side-live.mjs index be9701b6..2a511a89 100644 --- a/test/chrome-side-live.mjs +++ b/test/chrome-side-live.mjs @@ -24,13 +24,13 @@ import { fileURLToPath } from 'node:url'; const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..'); const H = process.env.CMCP_HELPER || join(ROOT, 'mcp-server', 'vendor', 'cmcp-helper'); const CHROME = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'; -if (!existsSync(CHROME)) { console.log('UMAALT Google Chrome er ikke installeret her'); process.exit(0); } +if (!existsSync(CHROME)) { console.log('SPRUNGET OVER: 7 (Google Chrome er ikke installeret her) - bevist intet, ikke bestaaet'); process.exit(0); } // ⛔ MAALT 5/11 kl. 02.09: mens Mac'en er LAAST, bygger Chrome ikke siders tilgaengeligheds-trae. // Et maaleprogram uden hjaelperen fandt 0 web-omraader efter 25,6 s paa en frisk Chrome (laast), // mod 2,1 s kl. 01.20 (ulaast). Proeven maaler da laasen, ikke koden - saa den siger UMAALT. { const io = execFileSync('ioreg', ['-n', 'Root', '-d1'], { encoding: 'utf8' }); - if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) { console.log('UMAALT skaermen er laast - Chrome bygger ingen sider imens'); process.exit(0); } + if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) { console.log('SPRUNGET OVER: 7 (skaermen er laast - Chrome bygger ingen sider imens) - bevist intet, ikke bestaaet'); process.exit(0); } } let fejl = 0; diff --git a/test/claims-offline.mjs b/test/claims-offline.mjs index 75575957..0ee31fd0 100644 --- a/test/claims-offline.mjs +++ b/test/claims-offline.mjs @@ -204,6 +204,9 @@ const LOEFTER = [ ['CMCP_INGEN_ELECTRON', 'Electron-kontakten kan slaas fra af brugeren'], // REVIEW 5/11 (Opus): uden den kunne en gammel binaer bestaa - samme klasse som 21/9. ['AXEnhancedUserInterface', 'Chrome-sider kan ses, og deres kodefelter sloeres'], + // R2 5/11 (Opus N11): evnen en chat spoerger efter med `version` - og grundene secure-rects nu giver. + // Navnet er over 15 tegn: kortere Swift-strenge ligger i koden og kan ikke findes her (maalt 5/11). + ['chrome-page-redaction', 'siger selv at den kan Chrome-sider (version)'], ]; const BIN = join(ROOT, 'mcp-server', 'vendor', 'cmcp-helper'); let raa = null; From 5e5a1c8c052292feafc4d08e1509310317c7a319 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Thu, 5 Nov 2026 07:40:54 +0100 Subject: [PATCH 42/94] Chrome-proeverne starter Chrome i baggrunden og maaler at personens forreste program ikke skifter; popup-proeve (N3) En direkte start hentede Chrome frem foran personen - kl. 06.35-06.47 sad Gustav i sit eget Chrome, mens proevevinduerne aabnede. Nu open -g -n (test/chrome-start.mjs), og hver proeve maaler forreste proces (ASN, ikke navn) MENS vinduet er aabent. chrome-popup-live.mjs: et window.open-popup med kodefelt - svaertet helt paa det kald der taender Chrome, kun feltet naar siden er bygget. Underrollen skrives ned. Co-Authored-By: Claude Opus 5.5 --- test/chrome-dyb-side-live.mjs | 19 +++++--- test/chrome-mcp-live.mjs | 19 +++++--- test/chrome-popup-live.mjs | 84 +++++++++++++++++++++++++++++++++++ test/chrome-side-live.mjs | 19 +++++--- test/chrome-start.mjs | 28 ++++++++++++ test/run-all.sh | 1 + 6 files changed, 152 insertions(+), 18 deletions(-) create mode 100644 test/chrome-popup-live.mjs create mode 100644 test/chrome-start.mjs diff --git a/test/chrome-dyb-side-live.mjs b/test/chrome-dyb-side-live.mjs index 8adfc05b..48f7e3d7 100644 --- a/test/chrome-dyb-side-live.mjs +++ b/test/chrome-dyb-side-live.mjs @@ -23,7 +23,8 @@ // Koeres bevidst: `node test/chrome-side-live.mjs`. Den roerer hverken mus eller tastatur, men den // aabner et lille Chrome-vindue med en engangs-profil i et par sekunder, og hjaelperen taender // Chromes trae ogsaa i dit eget Chrome (det er produktets adfaerd). Uden Google Chrome: UMAALT. -import { execFileSync, spawn } from 'node:child_process'; +import { execFileSync } from 'node:child_process'; +import { startChrome } from './chrome-start.mjs'; import { existsSync, mkdtempSync, writeFileSync, rmSync } from 'node:fs'; import { tmpdir } from 'node:os'; import { join, dirname } from 'node:path'; @@ -32,13 +33,13 @@ import { fileURLToPath } from 'node:url'; const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..'); const H = process.env.CMCP_HELPER || join(ROOT, 'mcp-server', 'vendor', 'cmcp-helper'); const CHROME = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'; -if (!existsSync(CHROME)) { console.log('SPRUNGET OVER: 4 (Google Chrome er ikke installeret her) - bevist intet, ikke bestaaet'); process.exit(0); } +if (!existsSync(CHROME)) { console.log('SPRUNGET OVER: 5 (Google Chrome er ikke installeret her) - bevist intet, ikke bestaaet'); process.exit(0); } // ⛔ MAALT 5/11 kl. 02.09: mens Mac'en er LAAST, bygger Chrome ikke siders tilgaengeligheds-trae. // Et maaleprogram uden hjaelperen fandt 0 web-omraader efter 25,6 s paa en frisk Chrome (laast), // mod 2,1 s kl. 01.20 (ulaast). Proeven maaler da laasen, ikke koden - saa den siger UMAALT. { const io = execFileSync('ioreg', ['-n', 'Root', '-d1'], { encoding: 'utf8' }); - if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) { console.log('SPRUNGET OVER: 4 (skaermen er laast - Chrome bygger ingen sider imens) - bevist intet, ikke bestaaet'); process.exit(0); } + if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) { console.log('SPRUNGET OVER: 5 (skaermen er laast - Chrome bygger ingen sider imens) - bevist intet, ikke bestaaet'); process.exit(0); } } let fejl = 0; @@ -56,10 +57,11 @@ ${'
'.repeat(45)} { try { process.kill(-chrome.pid); } catch {} try { chrome.kill('SIGKILL'); } catch {} try { rmSync(mappe, { recursive: true, force: true }); } catch {} }; + `file://${side}`]); +const ryd = () => { chrome.stop(); try { rmSync(mappe, { recursive: true, force: true }); } catch {} }; process.on('exit', ryd); const iVinduet = (r) => r.x >= V.x - 4 && r.y >= V.y - 4 && r.x + r.w <= V.x + V.w + 4 && r.y + r.h <= V.y + V.h + 4; @@ -70,6 +72,11 @@ try { let set = false; for (let i = 0; i < 40 && !set; i++) { await vent(250); set = hj(['find', '--app', 'com.google.Chrome', '--contains', 'CMCP-LIVE', '--depth', '6']).count > 0; } check('0. test-vinduet er aabnet', set, 'Chrome viste ikke vinduet paa 10 s'); + // 5/11: maalt MENS proevevinduet er aabent (efter lukning ville fokus vende tilbage og skjule det). + // Paa processen (ASN), ikke navnet - personens Chrome og proevens hedder begge «Google Chrome». + { const efter = chrome.forrestEfter(); + check('0b. personens forreste program er det samme som foer proeven', efter === chrome.forrestFoer, + `foer ${chrome.forrestFoer}, efter ${efter} (${chrome.forrestNavn()})`); } // Vent til siden er bygget (tekstfeltet ses), saa svaret ikke handler om opbygningen. let f = { count: 0 }; diff --git a/test/chrome-mcp-live.mjs b/test/chrome-mcp-live.mjs index 97d898e9..b104debd 100644 --- a/test/chrome-mcp-live.mjs +++ b/test/chrome-mcp-live.mjs @@ -13,7 +13,8 @@ // // Koeres bevidst: `node test/chrome-mcp-live.mjs`. Hjaelperen: CMCP_HELPER, ellers vendor/cmcp-helper. // Roerer hverken mus eller tastatur. Aabner et lille Chrome-vindue med en engangs-profil. -import { execFileSync, spawn } from 'node:child_process'; +import { execFileSync } from 'node:child_process'; +import { startChrome } from './chrome-start.mjs'; import { existsSync, mkdtempSync, writeFileSync, rmSync } from 'node:fs'; import { tmpdir } from 'node:os'; import { join, dirname } from 'node:path'; @@ -22,10 +23,10 @@ import { fileURLToPath } from 'node:url'; const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..'); const H = process.env.CMCP_HELPER || join(ROOT, 'mcp-server', 'vendor', 'cmcp-helper'); const CHROME = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'; -if (!existsSync(CHROME)) { console.log('SPRUNGET OVER: 5 (Google Chrome er ikke installeret her) - bevist intet, ikke bestaaet'); process.exit(0); } +if (!existsSync(CHROME)) { console.log('SPRUNGET OVER: 6 (Google Chrome er ikke installeret her) - bevist intet, ikke bestaaet'); process.exit(0); } { const io = execFileSync('ioreg', ['-n', 'Root', '-d1'], { encoding: 'utf8' }); - if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) { console.log('SPRUNGET OVER: 5 (skaermen er laast - Chrome bygger ingen sider imens) - bevist intet, ikke bestaaet'); process.exit(0); } + if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) { console.log('SPRUNGET OVER: 6 (skaermen er laast - Chrome bygger ingen sider imens) - bevist intet, ikke bestaaet'); process.exit(0); } } let fejl = 0; @@ -40,9 +41,10 @@ writeFileSync(side, `

${M}

`); -const chrome = spawn(CHROME, [`--user-data-dir=${join(mappe, 'profil')}`, '--no-first-run', '--no-default-browser-check', +// Startes i BAGGRUNDEN (open -g): en direkte start hentede Chrome frem foran personen (5/11). +const chrome = await startChrome([`--user-data-dir=${join(mappe, 'profil')}`, '--no-first-run', '--no-default-browser-check', '--disable-extensions', '--disable-session-crashed-bubble', '--window-position=60,90', '--window-size=720,520', - `file://${side}`], { stdio: 'ignore', detached: true }); + `file://${side}`]); const state = mkdtempSync(join(tmpdir(), 'cmcp-chrome-mcp-state-')); const { Client } = await import(join(ROOT, 'mcp-server', 'node_modules', '@modelcontextprotocol', 'sdk', 'dist', 'esm', 'client', 'index.js')); @@ -51,7 +53,7 @@ const env = { ...process.env, CMCP_HELPER: H, CMCP_STATE_DIR: state, CMCP_STATUS delete env.CMCP_BACKGROUND; const tr = new StdioClientTransport({ command: process.execPath, args: [join(ROOT, 'mcp-server', 'index.js')], env, stderr: 'ignore' }); const kl = new Client({ name: 'chrome-mcp-live', version: '1' }); -const ryd = () => { try { process.kill(-chrome.pid); } catch {} try { chrome.kill('SIGKILL'); } catch {} +const ryd = () => { chrome.stop(); for (const m of [mappe, state]) { try { rmSync(m, { recursive: true, force: true }); } catch {} } }; process.on('exit', ryd); @@ -72,6 +74,11 @@ try { { encoding: 'utf8', timeout: 15000, env: { ...process.env, CMCP_INGEN_ELECTRON: '1' } })).count > 0; } check('0. test-vinduet er aabnet', set, 'Chrome viste ikke vinduet paa 10 s'); + // 5/11: maalt MENS proevevinduet er aabent (efter lukning ville fokus vende tilbage og skjule det). + // Paa processen (ASN), ikke navnet - personens Chrome og proevens hedder begge «Google Chrome». + { const efter = chrome.forrestEfter(); + check('0b. personens forreste program er det samme som foer proeven', efter === chrome.forrestFoer, + `foer ${chrome.forrestFoer}, efter ${efter} (${chrome.forrestNavn()})`); } await kl.connect(tr); const f1 = await kald('computer_find', { app: 'com.google.Chrome', contains: `${M}-FELT`, depth: 60 }); diff --git a/test/chrome-popup-live.mjs b/test/chrome-popup-live.mjs new file mode 100644 index 00000000..0f9970ad --- /dev/null +++ b/test/chrome-popup-live.mjs @@ -0,0 +1,84 @@ +// Et Chrome-vindue der IKKE er et almindeligt browser-vindue: et popup fra window.open med et kodefelt. +// +// ⛔ R2 5/11 (Opus N3): porten galdt kun AXStandardWindow; en udvidelses-popup (1Password, Bitwarden) har +// web-indhold og en anden underrolle og sprang den over. En rigtig udvidelse kan ikke indlaeses i en +// engangs-profil (--load-extension er slaaet fra i Chrome siden 137), saa denne proeve bruger et popup- +// vindue og SKRIVER underrollen ned: er den AXStandardWindow, maaler proeven den gamle regel, og det siges. +// +// 1. kaldet der taender Chrome, svaerter popup-vinduet helt +// 2. naar popup'ens side er bygget, ses den +// 3. og saa svaertes KUN kodefeltet i popup'en, ikke hele vinduet +// +// Koeres bevidst: `node test/chrome-popup-live.mjs`. Roerer hverken mus eller tastatur. +import { execFileSync } from 'node:child_process'; +import { startChrome } from './chrome-start.mjs'; +import { existsSync, mkdtempSync, writeFileSync, rmSync } from 'node:fs'; +import { tmpdir } from 'node:os'; +import { join, dirname } from 'node:path'; +import { fileURLToPath } from 'node:url'; + +const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..'); +const H = process.env.CMCP_HELPER || join(ROOT, 'mcp-server', 'vendor', 'cmcp-helper'); +const CHROME = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'; +if (!existsSync(CHROME)) { console.log('SPRUNGET OVER: 5 (Google Chrome er ikke installeret her) - bevist intet, ikke bestaaet'); process.exit(0); } +{ + const io = execFileSync('ioreg', ['-n', 'Root', '-d1'], { encoding: 'utf8' }); + if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) { console.log('SPRUNGET OVER: 5 (skaermen er laast - Chrome bygger ingen sider imens) - bevist intet, ikke bestaaet'); process.exit(0); } +} +let fejl = 0; +const check = (navn, ok, hvorfor) => { console.log(`${ok ? 'OK ' : 'DUMP'} ${navn}${ok ? '' : ' - ' + hvorfor}`); if (!ok) fejl++; }; +const hj = (args, env) => JSON.parse(execFileSync(H, args, { encoding: 'utf8', timeout: 60000, env: env ? { ...process.env, ...env } : process.env })); +const vent = (ms) => new Promise((r) => setTimeout(r, ms)); +const M = `CMCPPOP${Date.now().toString(36).toUpperCase()}`; + +const mappe = mkdtempSync(join(tmpdir(), 'cmcp-chrome-pop-')); +writeFileSync(join(mappe, 'pop.html'), `${M}-POP +

${M}-TEKST

+

`); +writeFileSync(join(mappe, 'side.html'), `${M}-HOVED +

hovedside

`); +// Startes i BAGGRUNDEN (open -g): en direkte start hentede Chrome frem foran personen (5/11). +const chrome = await startChrome([`--user-data-dir=${join(mappe, 'profil')}`, '--no-first-run', '--no-default-browser-check', + '--disable-extensions', '--disable-popup-blocking', '--disable-session-crashed-bubble', '--window-position=60,90', + '--window-size=600,420', `file://${join(mappe, 'side.html')}`]); +const ryd = () => { chrome.stop(); try { rmSync(mappe, { recursive: true, force: true }); } catch {} }; +process.on('exit', ryd); + +try { + // Vent paa popup-vinduet (titlen, Chromes egen brugerflade) UDEN at taende traeet. + let pop = null; + for (let i = 0; i < 60 && !pop; i++) { + await vent(250); + // `find` (ikke `windows`) giver underrollen med. + const w = hj(['find', '--app', 'com.google.Chrome', '--role', 'AXWindow', '--contains', `${M}-POP`, '--depth', '3'], { CMCP_INGEN_ELECTRON: '1' }); + pop = (w.matches || [])[0] || null; + } + check('0. popup-vinduet er aabnet', !!pop, 'Chrome viste intet popup paa 15 s'); + // 5/11: maalt MENS proevevinduet er aabent (efter lukning ville fokus vende tilbage og skjule det). + // Paa processen (ASN), ikke navnet - personens Chrome og proevens hedder begge «Google Chrome». + { const efter = chrome.forrestEfter(); + check('0b. personens forreste program er det samme som foer proeven', efter === chrome.forrestFoer, + `foer ${chrome.forrestFoer}, efter ${efter} (${chrome.forrestNavn()})`); } + if (pop) { + const f = pop.frame || {}; + console.log(` popup-vinduets underrolle: ${pop.subrole ?? '(ikke i svaret)'} · ramme ${JSON.stringify(f)}`); + const iPop = (r) => r.x >= f.x - 4 && r.y >= f.y - 4 && r.x + r.w <= f.x + f.w + 4 && r.y + r.h <= f.y + f.h + 4; + const helePop = (r) => Math.abs(r.w - f.w) <= 8 && Math.abs(r.h - f.h) <= 8; + + const r1 = hj(['secure-rects', '--app', 'com.google.Chrome']); + check('1. kaldet der taender Chrome, svaerter popup-vinduet helt', r1.rects.filter(iPop).some(helePop), + `rekt ${JSON.stringify(r1.rects.filter(iPop))} grunde ${JSON.stringify(r1.whole_window)}`); + + let fnd = { count: 0 }; + for (let i = 0; i < 60 && !fnd.count; i++) { await vent(500); fnd = hj(['find', '--app', 'com.google.Chrome', '--contains', `${M}-NAVN`, '--depth', '60']); } + check('2. popup-sidens felt ses', fnd.count > 0, 'ikke fundet paa 30 s'); + + const r3 = hj(['secure-rects', '--app', 'com.google.Chrome']).rects.filter(iPop); + check('3. kun kodefeltet i popup\'en svaertes, ikke hele vinduet', + r3.length >= 1 && !r3.some(helePop) && r3.some((r) => r.w < 400 && r.h < 60), JSON.stringify(r3)); + } +} finally { + ryd(); +} +console.log(fejl ? `\n${fejl} DUMPET` : '\nBESTAAET'); +process.exit(fejl ? 1 : 0); diff --git a/test/chrome-side-live.mjs b/test/chrome-side-live.mjs index 2a511a89..536adc02 100644 --- a/test/chrome-side-live.mjs +++ b/test/chrome-side-live.mjs @@ -15,7 +15,8 @@ // Koeres bevidst: `node test/chrome-side-live.mjs`. Den roerer hverken mus eller tastatur, men den // aabner et lille Chrome-vindue med en engangs-profil i et par sekunder, og hjaelperen taender // Chromes trae ogsaa i dit eget Chrome (det er produktets adfaerd). Uden Google Chrome: UMAALT. -import { execFileSync, spawn } from 'node:child_process'; +import { execFileSync } from 'node:child_process'; +import { startChrome } from './chrome-start.mjs'; import { existsSync, mkdtempSync, writeFileSync, rmSync } from 'node:fs'; import { tmpdir } from 'node:os'; import { join, dirname } from 'node:path'; @@ -24,13 +25,13 @@ import { fileURLToPath } from 'node:url'; const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..'); const H = process.env.CMCP_HELPER || join(ROOT, 'mcp-server', 'vendor', 'cmcp-helper'); const CHROME = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'; -if (!existsSync(CHROME)) { console.log('SPRUNGET OVER: 7 (Google Chrome er ikke installeret her) - bevist intet, ikke bestaaet'); process.exit(0); } +if (!existsSync(CHROME)) { console.log('SPRUNGET OVER: 8 (Google Chrome er ikke installeret her) - bevist intet, ikke bestaaet'); process.exit(0); } // ⛔ MAALT 5/11 kl. 02.09: mens Mac'en er LAAST, bygger Chrome ikke siders tilgaengeligheds-trae. // Et maaleprogram uden hjaelperen fandt 0 web-omraader efter 25,6 s paa en frisk Chrome (laast), // mod 2,1 s kl. 01.20 (ulaast). Proeven maaler da laasen, ikke koden - saa den siger UMAALT. { const io = execFileSync('ioreg', ['-n', 'Root', '-d1'], { encoding: 'utf8' }); - if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) { console.log('SPRUNGET OVER: 7 (skaermen er laast - Chrome bygger ingen sider imens) - bevist intet, ikke bestaaet'); process.exit(0); } + if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) { console.log('SPRUNGET OVER: 8 (skaermen er laast - Chrome bygger ingen sider imens) - bevist intet, ikke bestaaet'); process.exit(0); } } let fejl = 0; @@ -47,10 +48,11 @@ writeFileSync(side, ` // Vinduets plads og stoerrelse er kendte, saa svarene kan holdes op mod netop det vindue - // hjaelperen ser ogsaa personens eget Chrome. const V = { x: 40, y: 80, w: 760, h: 560 }; -const chrome = spawn(CHROME, [`--user-data-dir=${join(mappe, 'profil')}`, '--no-first-run', '--no-default-browser-check', +// Startes i BAGGRUNDEN (open -g): en direkte start hentede Chrome frem foran personen (5/11). +const chrome = await startChrome([`--user-data-dir=${join(mappe, 'profil')}`, '--no-first-run', '--no-default-browser-check', '--disable-extensions', '--disable-session-crashed-bubble', `--window-position=${V.x},${V.y}`, `--window-size=${V.w},${V.h}`, - `file://${side}`], { stdio: 'ignore', detached: true }); -const ryd = () => { try { process.kill(-chrome.pid); } catch {} try { chrome.kill('SIGKILL'); } catch {} try { rmSync(mappe, { recursive: true, force: true }); } catch {} }; + `file://${side}`]); +const ryd = () => { chrome.stop(); try { rmSync(mappe, { recursive: true, force: true }); } catch {} }; process.on('exit', ryd); const iVinduet = (r) => r.x >= V.x - 4 && r.y >= V.y - 4 && r.x + r.w <= V.x + V.w + 4 && r.y + r.h <= V.y + V.h + 4; @@ -64,6 +66,11 @@ try { let set = false; for (let i = 0; i < 40 && !set; i++) { await vent(250); set = hj(['find', '--app', 'com.google.Chrome', '--contains', 'CMCP-LIVE', '--depth', '6'], undefined, { CMCP_INGEN_ELECTRON: '1' }).count > 0; } check('0. test-vinduet er aabnet', set, 'Chrome viste ikke vinduet paa 10 s'); + // 5/11: maalt MENS proevevinduet er aabent (efter lukning ville fokus vende tilbage og skjule det). + // Paa processen (ASN), ikke navnet - personens Chrome og proevens hedder begge «Google Chrome». + { const efter = chrome.forrestEfter(); + check('0b. personens forreste program er det samme som foer proeven', efter === chrome.forrestFoer, + `foer ${chrome.forrestFoer}, efter ${efter} (${chrome.forrestNavn()})`); } // 1. Det kald der taender traeet, ser ikke siden endnu - og skal sige hvorfor. const f1 = hj(['find', '--app', 'com.google.Chrome', '--contains', 'CMCPLIVEFELT', '--depth', '60']); diff --git a/test/chrome-start.mjs b/test/chrome-start.mjs new file mode 100644 index 00000000..6222b4a8 --- /dev/null +++ b/test/chrome-start.mjs @@ -0,0 +1,28 @@ +// Start en engangs-Chrome UDEN at tage personens forreste vindue. +// +// ⛔ 5/11 kl. ~07.40: prøverne startede Chrome direkte (spawn), og en ny Chrome-proces henter sig selv +// frem. Kl. 06.35-06.47 arbejdede personen i sit eget Chrome, mens prøvevinduerne åbnede. Nu: `open -g -n` +// (LaunchServices i baggrunden, ny instans), og prøven MÅLER bagefter at det forreste program er det samme. +import { execFileSync } from 'node:child_process'; + +const forrest = () => { try { return execFileSync('/usr/bin/lsappinfo', ['front'], { encoding: 'utf8' }).trim(); } catch { return '?'; } }; +const forrestNavn = () => { try { return execFileSync('/usr/bin/lsappinfo', ['info', '-only', 'name', forrest()], { encoding: 'utf8' }).trim(); } catch { return '?'; } }; + +/// Starter Chrome med de givne argumenter (profilen SKAL vaere en egen --user-data-dir). +/// Svarer { pid, stop(), forrestFoer, forrestEfter() }. +export async function startChrome(args) { + const profil = args.find((a) => a.startsWith('--user-data-dir=')); + if (!profil) throw new Error('startChrome kraever en egen --user-data-dir'); + const foer = forrest(); + execFileSync('/usr/bin/open', ['-g', '-n', '-a', 'Google Chrome', '--args', ...args]); + let pid = 0; + for (let i = 0; i < 40 && !pid; i++) { + await new Promise((r) => setTimeout(r, 250)); + try { pid = Number(execFileSync('/usr/bin/pgrep', ['-o', '-f', profil.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')], { encoding: 'utf8' }).trim().split('\n')[0]) || 0; } catch { /* ikke startet endnu */ } + } + const stop = () => { + try { execFileSync('/usr/bin/pkill', ['-f', profil.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')]); } catch { /* allerede vaek */ } + }; + // ASN, ikke navn: personens eget Chrome og test-Chrome hedder begge «Google Chrome». + return { pid, stop, forrestFoer: foer, forrestEfter: forrest, forrestNavn }; +} diff --git a/test/run-all.sh b/test/run-all.sh index 24575649..fc634fb0 100755 --- a/test/run-all.sh +++ b/test/run-all.sh @@ -139,6 +139,7 @@ run "web bagved" "node test/web-bagved.mjs" run "chrome-sider" "node test/chrome-side-live.mjs" run "chrome dyb side" "node test/chrome-dyb-side-live.mjs" run "chrome via server" "node test/chrome-mcp-live.mjs" +run "chrome popup" "node test/chrome-popup-live.mjs" run "sloeringens grund" "node test/redaction-note.mjs" run "menuvagt" "node test/menu-vagt.mjs" run "genaabn" "node test/genaabn.mjs" From 899b7475793886c4f4cf3bf02fc66fc0d9081a8a Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Thu, 5 Nov 2026 08:31:11 +0100 Subject: [PATCH 43/94] Chrome-proeverne rydder op (maalt) og starter kun Chrome naar personen ikke arbejder Maalt 5/11 08.21-08.28 (8 koersler): oprydningen lukkede INTET - moenstret startede med --user-data-dir=, og pgrep/pkill laeste det som et ukendt flag (illegal option). Naeste proeve maalte saa forrige proeves vinduer (dybde-proeven fandt et lavt kodefelt i et gammelt vindue). Nu kun stien, og oprydningen maales (tjek Z). Bevist begge veje mod en proces med samme slags argument. Chrome henter sig selv frem trods open -g (forreste proces skiftede 8 af 8): hver proeve springer over, hvis personen har vaeret aktiv inden for 60 s (HIDIdleTime). 0b er nu en oplysning, ikke et tjek. Co-Authored-By: Claude Opus 5.5 --- test/chrome-dyb-side-live.mjs | 14 ++++++++------ test/chrome-mcp-live.mjs | 14 ++++++++------ test/chrome-popup-live.mjs | 14 ++++++++------ test/chrome-side-live.mjs | 14 ++++++++------ test/chrome-start.mjs | 26 ++++++++++++++++++++++---- 5 files changed, 54 insertions(+), 28 deletions(-) diff --git a/test/chrome-dyb-side-live.mjs b/test/chrome-dyb-side-live.mjs index 48f7e3d7..a002ea65 100644 --- a/test/chrome-dyb-side-live.mjs +++ b/test/chrome-dyb-side-live.mjs @@ -24,7 +24,7 @@ // aabner et lille Chrome-vindue med en engangs-profil i et par sekunder, og hjaelperen taender // Chromes trae ogsaa i dit eget Chrome (det er produktets adfaerd). Uden Google Chrome: UMAALT. import { execFileSync } from 'node:child_process'; -import { startChrome } from './chrome-start.mjs'; +import { startChrome, inaktivSek, MIN_INAKTIV } from './chrome-start.mjs'; import { existsSync, mkdtempSync, writeFileSync, rmSync } from 'node:fs'; import { tmpdir } from 'node:os'; import { join, dirname } from 'node:path'; @@ -33,14 +33,16 @@ import { fileURLToPath } from 'node:url'; const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..'); const H = process.env.CMCP_HELPER || join(ROOT, 'mcp-server', 'vendor', 'cmcp-helper'); const CHROME = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'; -if (!existsSync(CHROME)) { console.log('SPRUNGET OVER: 5 (Google Chrome er ikke installeret her) - bevist intet, ikke bestaaet'); process.exit(0); } +if (!existsSync(CHROME)) { console.log('SPRUNGET OVER: 6 (Google Chrome er ikke installeret her) - bevist intet, ikke bestaaet'); process.exit(0); } // ⛔ MAALT 5/11 kl. 02.09: mens Mac'en er LAAST, bygger Chrome ikke siders tilgaengeligheds-trae. // Et maaleprogram uden hjaelperen fandt 0 web-omraader efter 25,6 s paa en frisk Chrome (laast), // mod 2,1 s kl. 01.20 (ulaast). Proeven maaler da laasen, ikke koden - saa den siger UMAALT. { const io = execFileSync('ioreg', ['-n', 'Root', '-d1'], { encoding: 'utf8' }); - if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) { console.log('SPRUNGET OVER: 5 (skaermen er laast - Chrome bygger ingen sider imens) - bevist intet, ikke bestaaet'); process.exit(0); } + if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) { console.log('SPRUNGET OVER: 6 (skaermen er laast - Chrome bygger ingen sider imens) - bevist intet, ikke bestaaet'); process.exit(0); } } +// ⛔ MAALT 5/11 08.21: Chrome henter sig selv frem trods `open -g`. Kun naar personen ikke arbejder. +if (inaktivSek() < MIN_INAKTIV) { console.log(`SPRUNGET OVER: 6 (personen arbejder lige nu - inaktiv ${Math.round(inaktivSek())} s; en ny Chrome henter sig selv frem foran dem) - bevist intet, ikke bestaaet`); process.exit(0); } let fejl = 0; const check = (navn, ok, hvorfor) => { console.log(`${ok ? 'OK ' : 'DUMP'} ${navn}${ok ? '' : ' - ' + hvorfor}`); if (!ok) fejl++; }; @@ -74,9 +76,8 @@ try { check('0. test-vinduet er aabnet', set, 'Chrome viste ikke vinduet paa 10 s'); // 5/11: maalt MENS proevevinduet er aabent (efter lukning ville fokus vende tilbage og skjule det). // Paa processen (ASN), ikke navnet - personens Chrome og proevens hedder begge «Google Chrome». - { const efter = chrome.forrestEfter(); - check('0b. personens forreste program er det samme som foer proeven', efter === chrome.forrestFoer, - `foer ${chrome.forrestFoer}, efter ${efter} (${chrome.forrestNavn()})`); } + // 0b (oplysning, ikke et tjek): MAALT 5/11 - Chrome tager forreste plads trods open -g; derfor inaktivitetsvagten. + console.log(` forreste proces foer/efter start: ${chrome.forrestFoer} / ${chrome.forrestEfter()} (${chrome.forrestNavn()})`); // Vent til siden er bygget (tekstfeltet ses), saa svaret ikke handler om opbygningen. let f = { count: 0 }; @@ -94,6 +95,7 @@ try { r.some(heleVinduet) && (sr.whole_window || []).some((g) => /deeper than the scan reaches/.test(g)), `rekt ${JSON.stringify(r)} grunde ${JSON.stringify(sr.whole_window)}`); } finally { + check('Z. proevens Chrome er lukket igen', chrome.stop(), 'den lever stadig - naeste proeve ville maale dens vinduer'); ryd(); } console.log(fejl ? `\n${fejl} DUMPET` : '\nBESTAAET'); diff --git a/test/chrome-mcp-live.mjs b/test/chrome-mcp-live.mjs index b104debd..208fac92 100644 --- a/test/chrome-mcp-live.mjs +++ b/test/chrome-mcp-live.mjs @@ -14,7 +14,7 @@ // Koeres bevidst: `node test/chrome-mcp-live.mjs`. Hjaelperen: CMCP_HELPER, ellers vendor/cmcp-helper. // Roerer hverken mus eller tastatur. Aabner et lille Chrome-vindue med en engangs-profil. import { execFileSync } from 'node:child_process'; -import { startChrome } from './chrome-start.mjs'; +import { startChrome, inaktivSek, MIN_INAKTIV } from './chrome-start.mjs'; import { existsSync, mkdtempSync, writeFileSync, rmSync } from 'node:fs'; import { tmpdir } from 'node:os'; import { join, dirname } from 'node:path'; @@ -23,11 +23,13 @@ import { fileURLToPath } from 'node:url'; const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..'); const H = process.env.CMCP_HELPER || join(ROOT, 'mcp-server', 'vendor', 'cmcp-helper'); const CHROME = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'; -if (!existsSync(CHROME)) { console.log('SPRUNGET OVER: 6 (Google Chrome er ikke installeret her) - bevist intet, ikke bestaaet'); process.exit(0); } +if (!existsSync(CHROME)) { console.log('SPRUNGET OVER: 7 (Google Chrome er ikke installeret her) - bevist intet, ikke bestaaet'); process.exit(0); } { const io = execFileSync('ioreg', ['-n', 'Root', '-d1'], { encoding: 'utf8' }); - if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) { console.log('SPRUNGET OVER: 6 (skaermen er laast - Chrome bygger ingen sider imens) - bevist intet, ikke bestaaet'); process.exit(0); } + if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) { console.log('SPRUNGET OVER: 7 (skaermen er laast - Chrome bygger ingen sider imens) - bevist intet, ikke bestaaet'); process.exit(0); } } +// ⛔ MAALT 5/11 08.21: Chrome henter sig selv frem trods `open -g`. Kun naar personen ikke arbejder. +if (inaktivSek() < MIN_INAKTIV) { console.log(`SPRUNGET OVER: 7 (personen arbejder lige nu - inaktiv ${Math.round(inaktivSek())} s; en ny Chrome henter sig selv frem foran dem) - bevist intet, ikke bestaaet`); process.exit(0); } let fejl = 0; const check = (navn, ok, hvorfor) => { console.log(`${ok ? 'OK ' : 'DUMP'} ${navn}${ok ? '' : ' - ' + hvorfor}`); if (!ok) fejl++; }; @@ -76,9 +78,8 @@ try { check('0. test-vinduet er aabnet', set, 'Chrome viste ikke vinduet paa 10 s'); // 5/11: maalt MENS proevevinduet er aabent (efter lukning ville fokus vende tilbage og skjule det). // Paa processen (ASN), ikke navnet - personens Chrome og proevens hedder begge «Google Chrome». - { const efter = chrome.forrestEfter(); - check('0b. personens forreste program er det samme som foer proeven', efter === chrome.forrestFoer, - `foer ${chrome.forrestFoer}, efter ${efter} (${chrome.forrestNavn()})`); } + // 0b (oplysning, ikke et tjek): MAALT 5/11 - Chrome tager forreste plads trods open -g; derfor inaktivitetsvagten. + console.log(` forreste proces foer/efter start: ${chrome.forrestFoer} / ${chrome.forrestEfter()} (${chrome.forrestNavn()})`); await kl.connect(tr); const f1 = await kald('computer_find', { app: 'com.google.Chrome', contains: `${M}-FELT`, depth: 60 }); @@ -108,6 +109,7 @@ try { else check('4. computer_set_value paa kodefeltet naegtes', s4.fejl && /secure/i.test(s4.tekst), s4.tekst.slice(0, 200)); } finally { try { await kl.close(); } catch {} + check('Z. proevens Chrome er lukket igen', chrome.stop(), 'den lever stadig - naeste proeve ville maale dens vinduer'); ryd(); } console.log(fejl ? `\n${fejl} DUMPET` : '\nBESTAAET'); diff --git a/test/chrome-popup-live.mjs b/test/chrome-popup-live.mjs index 0f9970ad..f359bb00 100644 --- a/test/chrome-popup-live.mjs +++ b/test/chrome-popup-live.mjs @@ -11,7 +11,7 @@ // // Koeres bevidst: `node test/chrome-popup-live.mjs`. Roerer hverken mus eller tastatur. import { execFileSync } from 'node:child_process'; -import { startChrome } from './chrome-start.mjs'; +import { startChrome, inaktivSek, MIN_INAKTIV } from './chrome-start.mjs'; import { existsSync, mkdtempSync, writeFileSync, rmSync } from 'node:fs'; import { tmpdir } from 'node:os'; import { join, dirname } from 'node:path'; @@ -20,11 +20,13 @@ import { fileURLToPath } from 'node:url'; const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..'); const H = process.env.CMCP_HELPER || join(ROOT, 'mcp-server', 'vendor', 'cmcp-helper'); const CHROME = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'; -if (!existsSync(CHROME)) { console.log('SPRUNGET OVER: 5 (Google Chrome er ikke installeret her) - bevist intet, ikke bestaaet'); process.exit(0); } +if (!existsSync(CHROME)) { console.log('SPRUNGET OVER: 6 (Google Chrome er ikke installeret her) - bevist intet, ikke bestaaet'); process.exit(0); } { const io = execFileSync('ioreg', ['-n', 'Root', '-d1'], { encoding: 'utf8' }); - if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) { console.log('SPRUNGET OVER: 5 (skaermen er laast - Chrome bygger ingen sider imens) - bevist intet, ikke bestaaet'); process.exit(0); } + if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) { console.log('SPRUNGET OVER: 6 (skaermen er laast - Chrome bygger ingen sider imens) - bevist intet, ikke bestaaet'); process.exit(0); } } +// ⛔ MAALT 5/11 08.21: Chrome henter sig selv frem trods `open -g`. Kun naar personen ikke arbejder. +if (inaktivSek() < MIN_INAKTIV) { console.log(`SPRUNGET OVER: 6 (personen arbejder lige nu - inaktiv ${Math.round(inaktivSek())} s; en ny Chrome henter sig selv frem foran dem) - bevist intet, ikke bestaaet`); process.exit(0); } let fejl = 0; const check = (navn, ok, hvorfor) => { console.log(`${ok ? 'OK ' : 'DUMP'} ${navn}${ok ? '' : ' - ' + hvorfor}`); if (!ok) fejl++; }; const hj = (args, env) => JSON.parse(execFileSync(H, args, { encoding: 'utf8', timeout: 60000, env: env ? { ...process.env, ...env } : process.env })); @@ -56,9 +58,8 @@ try { check('0. popup-vinduet er aabnet', !!pop, 'Chrome viste intet popup paa 15 s'); // 5/11: maalt MENS proevevinduet er aabent (efter lukning ville fokus vende tilbage og skjule det). // Paa processen (ASN), ikke navnet - personens Chrome og proevens hedder begge «Google Chrome». - { const efter = chrome.forrestEfter(); - check('0b. personens forreste program er det samme som foer proeven', efter === chrome.forrestFoer, - `foer ${chrome.forrestFoer}, efter ${efter} (${chrome.forrestNavn()})`); } + // 0b (oplysning, ikke et tjek): MAALT 5/11 - Chrome tager forreste plads trods open -g; derfor inaktivitetsvagten. + console.log(` forreste proces foer/efter start: ${chrome.forrestFoer} / ${chrome.forrestEfter()} (${chrome.forrestNavn()})`); if (pop) { const f = pop.frame || {}; console.log(` popup-vinduets underrolle: ${pop.subrole ?? '(ikke i svaret)'} · ramme ${JSON.stringify(f)}`); @@ -78,6 +79,7 @@ try { r3.length >= 1 && !r3.some(helePop) && r3.some((r) => r.w < 400 && r.h < 60), JSON.stringify(r3)); } } finally { + check('Z. proevens Chrome er lukket igen', chrome.stop(), 'den lever stadig - naeste proeve ville maale dens vinduer'); ryd(); } console.log(fejl ? `\n${fejl} DUMPET` : '\nBESTAAET'); diff --git a/test/chrome-side-live.mjs b/test/chrome-side-live.mjs index 536adc02..64dbb7de 100644 --- a/test/chrome-side-live.mjs +++ b/test/chrome-side-live.mjs @@ -16,7 +16,7 @@ // aabner et lille Chrome-vindue med en engangs-profil i et par sekunder, og hjaelperen taender // Chromes trae ogsaa i dit eget Chrome (det er produktets adfaerd). Uden Google Chrome: UMAALT. import { execFileSync } from 'node:child_process'; -import { startChrome } from './chrome-start.mjs'; +import { startChrome, inaktivSek, MIN_INAKTIV } from './chrome-start.mjs'; import { existsSync, mkdtempSync, writeFileSync, rmSync } from 'node:fs'; import { tmpdir } from 'node:os'; import { join, dirname } from 'node:path'; @@ -25,14 +25,16 @@ import { fileURLToPath } from 'node:url'; const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..'); const H = process.env.CMCP_HELPER || join(ROOT, 'mcp-server', 'vendor', 'cmcp-helper'); const CHROME = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'; -if (!existsSync(CHROME)) { console.log('SPRUNGET OVER: 8 (Google Chrome er ikke installeret her) - bevist intet, ikke bestaaet'); process.exit(0); } +if (!existsSync(CHROME)) { console.log('SPRUNGET OVER: 9 (Google Chrome er ikke installeret her) - bevist intet, ikke bestaaet'); process.exit(0); } // ⛔ MAALT 5/11 kl. 02.09: mens Mac'en er LAAST, bygger Chrome ikke siders tilgaengeligheds-trae. // Et maaleprogram uden hjaelperen fandt 0 web-omraader efter 25,6 s paa en frisk Chrome (laast), // mod 2,1 s kl. 01.20 (ulaast). Proeven maaler da laasen, ikke koden - saa den siger UMAALT. { const io = execFileSync('ioreg', ['-n', 'Root', '-d1'], { encoding: 'utf8' }); - if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) { console.log('SPRUNGET OVER: 8 (skaermen er laast - Chrome bygger ingen sider imens) - bevist intet, ikke bestaaet'); process.exit(0); } + if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) { console.log('SPRUNGET OVER: 9 (skaermen er laast - Chrome bygger ingen sider imens) - bevist intet, ikke bestaaet'); process.exit(0); } } +// ⛔ MAALT 5/11 08.21: Chrome henter sig selv frem trods `open -g`. Kun naar personen ikke arbejder. +if (inaktivSek() < MIN_INAKTIV) { console.log(`SPRUNGET OVER: 9 (personen arbejder lige nu - inaktiv ${Math.round(inaktivSek())} s; en ny Chrome henter sig selv frem foran dem) - bevist intet, ikke bestaaet`); process.exit(0); } let fejl = 0; const check = (navn, ok, hvorfor) => { console.log(`${ok ? 'OK ' : 'DUMP'} ${navn}${ok ? '' : ' - ' + hvorfor}`); if (!ok) fejl++; }; @@ -68,9 +70,8 @@ try { check('0. test-vinduet er aabnet', set, 'Chrome viste ikke vinduet paa 10 s'); // 5/11: maalt MENS proevevinduet er aabent (efter lukning ville fokus vende tilbage og skjule det). // Paa processen (ASN), ikke navnet - personens Chrome og proevens hedder begge «Google Chrome». - { const efter = chrome.forrestEfter(); - check('0b. personens forreste program er det samme som foer proeven', efter === chrome.forrestFoer, - `foer ${chrome.forrestFoer}, efter ${efter} (${chrome.forrestNavn()})`); } + // 0b (oplysning, ikke et tjek): MAALT 5/11 - Chrome tager forreste plads trods open -g; derfor inaktivitetsvagten. + console.log(` forreste proces foer/efter start: ${chrome.forrestFoer} / ${chrome.forrestEfter()} (${chrome.forrestNavn()})`); // 1. Det kald der taender traeet, ser ikke siden endnu - og skal sige hvorfor. const f1 = hj(['find', '--app', 'com.google.Chrome', '--contains', 'CMCPLIVEFELT', '--depth', '60']); @@ -107,6 +108,7 @@ try { catch (e) { s6 = JSON.parse(e.stdout || '{}'); } check('6. skrivning i kodefeltet naegtes', s6.ok === false && s6.code === 'secure-field', JSON.stringify(s6).slice(0, 160)); } finally { + check('Z. proevens Chrome er lukket igen', chrome.stop(), 'den lever stadig - naeste proeve ville maale dens vinduer'); ryd(); } console.log(fejl ? `\n${fejl} DUMPET` : '\nBESTAAET'); diff --git a/test/chrome-start.mjs b/test/chrome-start.mjs index 6222b4a8..deaf6e55 100644 --- a/test/chrome-start.mjs +++ b/test/chrome-start.mjs @@ -10,18 +10,36 @@ const forrestNavn = () => { try { return execFileSync('/usr/bin/lsappinfo', ['in /// Starter Chrome med de givne argumenter (profilen SKAL vaere en egen --user-data-dir). /// Svarer { pid, stop(), forrestFoer, forrestEfter() }. +/// Sekunder siden personen sidst rørte mus eller tastatur (HIDIdleTime, uden hjaelperen). +export function inaktivSek() { + try { const m = execFileSync('/usr/sbin/ioreg', ['-c', 'IOHIDSystem', '-d', '4'], { encoding: 'utf8' }).match(/"HIDIdleTime" = (\d+)/); + return m ? Number(m[1]) / 1e9 : 0; } catch { return 0; } +} +/// ⛔ MAALT 5/11 kl. 08.21: Chrome henter sig selv frem trods `open -g` (forreste proces skiftede i 8 af 8 +/// koersler). En proeve maa derfor kun starte en Chrome, naar personen IKKE arbejder - og den spoerger +/// lige foer starten, ikke kun foer hele suiten. +export const MIN_INAKTIV = 60; + export async function startChrome(args) { - const profil = args.find((a) => a.startsWith('--user-data-dir=')); - if (!profil) throw new Error('startChrome kraever en egen --user-data-dir'); + const profilArg = args.find((a) => a.startsWith('--user-data-dir=')); + if (!profilArg) throw new Error('startChrome kraever en egen --user-data-dir'); + // ⛔ MAALT 5/11 kl. 08.2x: moenstret startede med «--user-data-dir=», og pgrep/pkill laeste det som et + // ukendt flag - oprydningen lukkede INTET, og naeste proeve maalte forrige proeves vinduer. Kun stien. + const profil = profilArg.slice('--user-data-dir='.length); + const moenster = profil.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'); const foer = forrest(); execFileSync('/usr/bin/open', ['-g', '-n', '-a', 'Google Chrome', '--args', ...args]); let pid = 0; for (let i = 0; i < 40 && !pid; i++) { await new Promise((r) => setTimeout(r, 250)); - try { pid = Number(execFileSync('/usr/bin/pgrep', ['-o', '-f', profil.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')], { encoding: 'utf8' }).trim().split('\n')[0]) || 0; } catch { /* ikke startet endnu */ } + try { pid = Number(execFileSync('/usr/bin/pgrep', ['-o', '-f', moenster], { encoding: 'utf8' }).trim().split('\n')[0]) || 0; } catch { /* ikke startet endnu */ } } const stop = () => { - try { execFileSync('/usr/bin/pkill', ['-f', profil.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')]); } catch { /* allerede vaek */ } + try { execFileSync('/usr/bin/pkill', ['-f', moenster]); } catch { /* allerede vaek */ } + // Maal at den er vaek - en oprydning der ikke virker, var hele fejlen 08.2x. + for (let i = 0; i < 20; i++) { try { execFileSync('/usr/bin/pgrep', ['-f', moenster]); } catch { return true; } execFileSync('/bin/sleep', ['0.25']); } + try { execFileSync('/usr/bin/pkill', ['-9', '-f', moenster]); } catch { /* vaek */ } + return false; }; // ASN, ikke navn: personens eget Chrome og test-Chrome hedder begge «Google Chrome». return { pid, stop, forrestFoer: foer, forrestEfter: forrest, forrestNavn }; From c991b5f3a6c8977472d6c9640e88b18bb6c24452 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Thu, 5 Nov 2026 08:32:05 +0100 Subject: [PATCH 44/94] Serverproeven: skrivning gennem serveren fjernet - den kunne aldrig maales her Proevens Chrome henter sig selv frem, og serverens baggrundsvagt venter altid paa et program der er forrest, uanset om personen er inaktiv (maalt 08.21: sprunget over begge runder). Skrivning og afslag er bevist paa hjaelper-niveau (chrome-side-live 5-6). Co-Authored-By: Claude Opus 5.5 --- test/chrome-mcp-live.mjs | 30 ++++++++---------------------- 1 file changed, 8 insertions(+), 22 deletions(-) diff --git a/test/chrome-mcp-live.mjs b/test/chrome-mcp-live.mjs index 208fac92..dcbda6b0 100644 --- a/test/chrome-mcp-live.mjs +++ b/test/chrome-mcp-live.mjs @@ -8,8 +8,6 @@ // // 1. serverens foerste find paa en ubygget side svarer tree_building (feltet naar frem til klienten) // 2. siden ses gennem serveren -// 3. computer_set_value skriver i tekstfeltet, verified -// 4. computer_set_value paa kodefeltet naegtes (secure-field) // // Koeres bevidst: `node test/chrome-mcp-live.mjs`. Hjaelperen: CMCP_HELPER, ellers vendor/cmcp-helper. // Roerer hverken mus eller tastatur. Aabner et lille Chrome-vindue med en engangs-profil. @@ -23,13 +21,13 @@ import { fileURLToPath } from 'node:url'; const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..'); const H = process.env.CMCP_HELPER || join(ROOT, 'mcp-server', 'vendor', 'cmcp-helper'); const CHROME = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'; -if (!existsSync(CHROME)) { console.log('SPRUNGET OVER: 7 (Google Chrome er ikke installeret her) - bevist intet, ikke bestaaet'); process.exit(0); } +if (!existsSync(CHROME)) { console.log('SPRUNGET OVER: 4 (Google Chrome er ikke installeret her) - bevist intet, ikke bestaaet'); process.exit(0); } { const io = execFileSync('ioreg', ['-n', 'Root', '-d1'], { encoding: 'utf8' }); - if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) { console.log('SPRUNGET OVER: 7 (skaermen er laast - Chrome bygger ingen sider imens) - bevist intet, ikke bestaaet'); process.exit(0); } + if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) { console.log('SPRUNGET OVER: 4 (skaermen er laast - Chrome bygger ingen sider imens) - bevist intet, ikke bestaaet'); process.exit(0); } } // ⛔ MAALT 5/11 08.21: Chrome henter sig selv frem trods `open -g`. Kun naar personen ikke arbejder. -if (inaktivSek() < MIN_INAKTIV) { console.log(`SPRUNGET OVER: 7 (personen arbejder lige nu - inaktiv ${Math.round(inaktivSek())} s; en ny Chrome henter sig selv frem foran dem) - bevist intet, ikke bestaaet`); process.exit(0); } +if (inaktivSek() < MIN_INAKTIV) { console.log(`SPRUNGET OVER: 4 (personen arbejder lige nu - inaktiv ${Math.round(inaktivSek())} s; en ny Chrome henter sig selv frem foran dem) - bevist intet, ikke bestaaet`); process.exit(0); } let fejl = 0; const check = (navn, ok, hvorfor) => { console.log(`${ok ? 'OK ' : 'DUMP'} ${navn}${ok ? '' : ' - ' + hvorfor}`); if (!ok) fejl++; }; @@ -90,23 +88,11 @@ try { for (let i = 0; i < 60 && !f2.json?.count; i++) { await vent(500); f2 = await kald('computer_find', { app: 'com.google.Chrome', contains: `${M}-FELT`, depth: 60 }); } check('2. siden ses gennem serveren', f2.json?.count > 0 && f2.json.matches.some((m) => m.role === 'AXTextArea'), f2.tekst.slice(0, 200)); - // ⛔ MAALT 5/11 kl. 06.47: arbejder personen i SIT Chrome, venter serverens vagt 40 s og skriver intet - - // vagten skelner paa program-id, og test-vinduet er ogsaa com.google.Chrome. Det er produktets - // adfaerd, ikke en fejl: proeven siger UMAALT for skrivningen, ikke DUMPET. - const venter = (r) => /^Waiting:/.test(r.tekst); - const s3 = await kald('computer_set_value', { app: 'com.google.Chrome', contains: `${M}-FELT`, role: 'AXTextArea', text: 'skrevet gennem serveren' }); - if (venter(s3)) console.log('SPRUNGET OVER: 1 (3. skrivning gennem serveren: personen arbejder i Chrome, vagten venter som den skal) - bevist intet, ikke bestaaet'); - else { - // ⛔ R2 (Astra, MAALT): /verified/ matchede ogsaa «"verified":false». Kraev sand vaerdi OG tilbagelaesning. - const tilbage = await kald('computer_find', { app: 'com.google.Chrome', contains: `${M}-FELT`, role: 'AXTextArea', depth: 60 }); - check('3. computer_set_value skriver i tekstfeltet, verified og laest tilbage', - !s3.fejl && s3.json?.verified === true && JSON.stringify(tilbage.json?.matches?.[0]?.names || []).includes('skrevet gennem serveren'), - s3.tekst.slice(0, 200)); - } - - const s4 = venter(s3) ? s3 : await kald('computer_set_value', { app: 'com.google.Chrome', contains: `${M}-KODE`, subrole: 'AXSecureTextField', text: 'maa-aldrig-lande' }); - if (venter(s4)) console.log('SPRUNGET OVER: 1 (4. afslag paa kodefeltet gennem serveren: samme grund) - bevist intet, ikke bestaaet'); - else check('4. computer_set_value paa kodefeltet naegtes', s4.fejl && /secure/i.test(s4.tekst), s4.tekst.slice(0, 200)); + // ⛔ 3-4 (skrivning gennem serveren) er FJERNET med vilje, maalt 5/11 08.21: proevens Chrome henter sig selv + // frem, og serverens baggrundsvagt venter altid paa et program der er forrest (index.js «is still the window + // the person is working in») - uanset om personen er inaktiv. Skrivningen kunne derfor aldrig maales her, + // kun springes over. Den er bevist paa hjaelper-niveau (chrome-side-live 5-6), og serveren sender + // set_value videre ad samme vej for alle programmer. At slaa baggrundstilstanden fra er husets larmende vej. } finally { try { await kl.close(); } catch {} check('Z. proevens Chrome er lukket igen', chrome.stop(), 'den lever stadig - naeste proeve ville maale dens vinduer'); From 6acf32f67aa5f74ad872c8f8883da5b0aa985e8a Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Thu, 5 Nov 2026 08:32:15 +0100 Subject: [PATCH 45/94] Chrome-proeverne: SPRUNGET-tallet er antallet af tjek Co-Authored-By: Claude Opus 5.5 --- test/chrome-dyb-side-live.mjs | 6 +++--- test/chrome-popup-live.mjs | 6 +++--- test/chrome-side-live.mjs | 6 +++--- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/test/chrome-dyb-side-live.mjs b/test/chrome-dyb-side-live.mjs index a002ea65..05090350 100644 --- a/test/chrome-dyb-side-live.mjs +++ b/test/chrome-dyb-side-live.mjs @@ -33,16 +33,16 @@ import { fileURLToPath } from 'node:url'; const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..'); const H = process.env.CMCP_HELPER || join(ROOT, 'mcp-server', 'vendor', 'cmcp-helper'); const CHROME = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'; -if (!existsSync(CHROME)) { console.log('SPRUNGET OVER: 6 (Google Chrome er ikke installeret her) - bevist intet, ikke bestaaet'); process.exit(0); } +if (!existsSync(CHROME)) { console.log('SPRUNGET OVER: 5 (Google Chrome er ikke installeret her) - bevist intet, ikke bestaaet'); process.exit(0); } // ⛔ MAALT 5/11 kl. 02.09: mens Mac'en er LAAST, bygger Chrome ikke siders tilgaengeligheds-trae. // Et maaleprogram uden hjaelperen fandt 0 web-omraader efter 25,6 s paa en frisk Chrome (laast), // mod 2,1 s kl. 01.20 (ulaast). Proeven maaler da laasen, ikke koden - saa den siger UMAALT. { const io = execFileSync('ioreg', ['-n', 'Root', '-d1'], { encoding: 'utf8' }); - if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) { console.log('SPRUNGET OVER: 6 (skaermen er laast - Chrome bygger ingen sider imens) - bevist intet, ikke bestaaet'); process.exit(0); } + if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) { console.log('SPRUNGET OVER: 5 (skaermen er laast - Chrome bygger ingen sider imens) - bevist intet, ikke bestaaet'); process.exit(0); } } // ⛔ MAALT 5/11 08.21: Chrome henter sig selv frem trods `open -g`. Kun naar personen ikke arbejder. -if (inaktivSek() < MIN_INAKTIV) { console.log(`SPRUNGET OVER: 6 (personen arbejder lige nu - inaktiv ${Math.round(inaktivSek())} s; en ny Chrome henter sig selv frem foran dem) - bevist intet, ikke bestaaet`); process.exit(0); } +if (inaktivSek() < MIN_INAKTIV) { console.log(`SPRUNGET OVER: 5 (personen arbejder lige nu - inaktiv ${Math.round(inaktivSek())} s; en ny Chrome henter sig selv frem foran dem) - bevist intet, ikke bestaaet`); process.exit(0); } let fejl = 0; const check = (navn, ok, hvorfor) => { console.log(`${ok ? 'OK ' : 'DUMP'} ${navn}${ok ? '' : ' - ' + hvorfor}`); if (!ok) fejl++; }; diff --git a/test/chrome-popup-live.mjs b/test/chrome-popup-live.mjs index f359bb00..c38778b0 100644 --- a/test/chrome-popup-live.mjs +++ b/test/chrome-popup-live.mjs @@ -20,13 +20,13 @@ import { fileURLToPath } from 'node:url'; const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..'); const H = process.env.CMCP_HELPER || join(ROOT, 'mcp-server', 'vendor', 'cmcp-helper'); const CHROME = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'; -if (!existsSync(CHROME)) { console.log('SPRUNGET OVER: 6 (Google Chrome er ikke installeret her) - bevist intet, ikke bestaaet'); process.exit(0); } +if (!existsSync(CHROME)) { console.log('SPRUNGET OVER: 5 (Google Chrome er ikke installeret her) - bevist intet, ikke bestaaet'); process.exit(0); } { const io = execFileSync('ioreg', ['-n', 'Root', '-d1'], { encoding: 'utf8' }); - if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) { console.log('SPRUNGET OVER: 6 (skaermen er laast - Chrome bygger ingen sider imens) - bevist intet, ikke bestaaet'); process.exit(0); } + if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) { console.log('SPRUNGET OVER: 5 (skaermen er laast - Chrome bygger ingen sider imens) - bevist intet, ikke bestaaet'); process.exit(0); } } // ⛔ MAALT 5/11 08.21: Chrome henter sig selv frem trods `open -g`. Kun naar personen ikke arbejder. -if (inaktivSek() < MIN_INAKTIV) { console.log(`SPRUNGET OVER: 6 (personen arbejder lige nu - inaktiv ${Math.round(inaktivSek())} s; en ny Chrome henter sig selv frem foran dem) - bevist intet, ikke bestaaet`); process.exit(0); } +if (inaktivSek() < MIN_INAKTIV) { console.log(`SPRUNGET OVER: 5 (personen arbejder lige nu - inaktiv ${Math.round(inaktivSek())} s; en ny Chrome henter sig selv frem foran dem) - bevist intet, ikke bestaaet`); process.exit(0); } let fejl = 0; const check = (navn, ok, hvorfor) => { console.log(`${ok ? 'OK ' : 'DUMP'} ${navn}${ok ? '' : ' - ' + hvorfor}`); if (!ok) fejl++; }; const hj = (args, env) => JSON.parse(execFileSync(H, args, { encoding: 'utf8', timeout: 60000, env: env ? { ...process.env, ...env } : process.env })); diff --git a/test/chrome-side-live.mjs b/test/chrome-side-live.mjs index 64dbb7de..23ff4181 100644 --- a/test/chrome-side-live.mjs +++ b/test/chrome-side-live.mjs @@ -25,16 +25,16 @@ import { fileURLToPath } from 'node:url'; const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..'); const H = process.env.CMCP_HELPER || join(ROOT, 'mcp-server', 'vendor', 'cmcp-helper'); const CHROME = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'; -if (!existsSync(CHROME)) { console.log('SPRUNGET OVER: 9 (Google Chrome er ikke installeret her) - bevist intet, ikke bestaaet'); process.exit(0); } +if (!existsSync(CHROME)) { console.log('SPRUNGET OVER: 8 (Google Chrome er ikke installeret her) - bevist intet, ikke bestaaet'); process.exit(0); } // ⛔ MAALT 5/11 kl. 02.09: mens Mac'en er LAAST, bygger Chrome ikke siders tilgaengeligheds-trae. // Et maaleprogram uden hjaelperen fandt 0 web-omraader efter 25,6 s paa en frisk Chrome (laast), // mod 2,1 s kl. 01.20 (ulaast). Proeven maaler da laasen, ikke koden - saa den siger UMAALT. { const io = execFileSync('ioreg', ['-n', 'Root', '-d1'], { encoding: 'utf8' }); - if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) { console.log('SPRUNGET OVER: 9 (skaermen er laast - Chrome bygger ingen sider imens) - bevist intet, ikke bestaaet'); process.exit(0); } + if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) { console.log('SPRUNGET OVER: 8 (skaermen er laast - Chrome bygger ingen sider imens) - bevist intet, ikke bestaaet'); process.exit(0); } } // ⛔ MAALT 5/11 08.21: Chrome henter sig selv frem trods `open -g`. Kun naar personen ikke arbejder. -if (inaktivSek() < MIN_INAKTIV) { console.log(`SPRUNGET OVER: 9 (personen arbejder lige nu - inaktiv ${Math.round(inaktivSek())} s; en ny Chrome henter sig selv frem foran dem) - bevist intet, ikke bestaaet`); process.exit(0); } +if (inaktivSek() < MIN_INAKTIV) { console.log(`SPRUNGET OVER: 8 (personen arbejder lige nu - inaktiv ${Math.round(inaktivSek())} s; en ny Chrome henter sig selv frem foran dem) - bevist intet, ikke bestaaet`); process.exit(0); } let fejl = 0; const check = (navn, ok, hvorfor) => { console.log(`${ok ? 'OK ' : 'DUMP'} ${navn}${ok ? '' : ' - ' + hvorfor}`); if (!ok) fejl++; }; From 264e58a8d34ade7a32b590f383791717c7a8c24b Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Thu, 5 Nov 2026 08:40:21 +0100 Subject: [PATCH 46/94] CHANGELOG siger hvad mutanterne faktisk viste 5/11: fire roede, to der overlever og hvorfor Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index f99d73ef..b6007856 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -22,12 +22,17 @@ dropped by the server (`test/redaction-note.mjs`, both directions mutation-prove Costs and changes, written in the README: Chrome keeps full accessibility mode until it quits; its windows may animate when moved (not measured); password managers that run inside Chrome can be read as text; `CMCP_INGEN_ELECTRON=1` leaves Chrome off too. -Only Google Chrome is measured. Tests: `test/chrome-side-live.mjs` (against a real -Chrome; four mutants - no blackout, web area always "built", Chrome never recognised, -`tree_building` off - each turn it red), `test/chrome-dyb-side-live.mjs` (a password -field deeper than the scan reaches blacks the window out), `test/chrome-mcp-live.mjs` -(the same through the MCP server; red on a helper without the switch) and -`test/claims-offline.mjs` 8b-8f (that the code and the shipped binary carry the switch). +Only Google Chrome is measured. Tests against a real Chrome: `test/chrome-side-live.mjs`, +`test/chrome-dyb-side-live.mjs` (a password field deeper than the scan reaches blacks +the window out), `test/chrome-popup-live.mjs` and `test/chrome-mcp-live.mjs` (through +the MCP server; red on a helper without the switch) - all green twice on 5 Nov. Four +mutants turn them red: the gate blacks out nothing, an empty web area counts as built, +Chrome is never recognised, the depth-and-lookup rule removed. Two do not: turning off +the "switched on just now" flag (the search's own check gives the same signal), and the +rule for windows that are not ordinary browser windows (no such window with a page could +be made: Chrome does not load an unpacked extension from the command line). Evidence in +the 5 Nov run logs. `test/claims-offline.mjs` 8b-8f checks that the code and the shipped +binary carry the switch. After a second review (two reviewers, 5 Nov) the gate fails closed in more places: a Chrome window passes only when the search for its pages reached the end and no lookup answered "don't know" (a timeout, an element Chrome rebuilt mid-scan, a failure); a From 245a06d46b86f56ab61f928d10d0c9b533ef832e Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Thu, 5 Nov 2026 09:03:46 +0100 Subject: [PATCH 47/94] Vault-porten: adgangskode-sider inde i en browser holdes ude som de native programmer MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Gustav 5/11: «kør e2e også password programmer i chrome». Da Chrome-sider blev laeselige, blev 1Password-/Bitwarden-popups, web-hvaelv og Chromes egen kodeordsside det ogsaa - som tekst. Porten sidder paa web-omraadet (AXWebArea), ikke vinduet, saa en forslagsmenu inde i en anden side er med: - adressen (AXURL) mod Chromes/Edges/Braves egne kodeordssider, ni web-hvaelv (hver svarede 5/11) og tolv udvidelses-id'er (hver slaaet op i Chrome Web Store 5/11). Kan adressen ikke laeses, afgoer titlen - lukket. - find og inspect gaar ikke ned i siden og siger hvad de sprang over; focused siger kun «denied»; type, taster, indsaet og set_value uden maal naegter (fokusErSikkert). - skaermbilledet svaerter hele vinduet med grunden. Ikke daekket: selvhostede hvaelv, ukendte udvidelser (den nye NordPass-udvidelses id kunne ikke bekraeftes), skaermoptagelser. Proeve: chrome-vault-live.mjs mod chrome://password-manager, med oejebliksbillede foer start, saa personens egne vinduer hverken taelles eller skrives ud. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 15 ++- README.md | 15 ++- docs/llms.txt | 11 +- docs/security.html | 2 +- .../Sources/cmcp-helper/Accessibility.swift | 117 +++++++++++++++++- helper/Sources/cmcp-helper/main.swift | 11 +- mcp-server/README.md | 15 ++- mcp-server/index.js | 6 +- test/chrome-vault-live.mjs | 95 ++++++++++++++ test/claims-offline.mjs | 16 +++ test/run-all.sh | 1 + 11 files changed, 283 insertions(+), 21 deletions(-) create mode 100644 test/chrome-vault-live.mjs diff --git a/CHANGELOG.md b/CHANGELOG.md index b6007856..e1c5a78c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -21,7 +21,7 @@ and now say why: the helper's `redaction_note` reaches the agent instead of bein dropped by the server (`test/redaction-note.mjs`, both directions mutation-proven). Costs and changes, written in the README: Chrome keeps full accessibility mode until it quits; its windows may animate when moved (not measured); password managers that -run inside Chrome can be read as text; `CMCP_INGEN_ELECTRON=1` leaves Chrome off too. +run inside a browser are treated like the native ones (see below); `CMCP_INGEN_ELECTRON=1` leaves Chrome off too. Only Google Chrome is measured. Tests against a real Chrome: `test/chrome-side-live.mjs`, `test/chrome-dyb-side-live.mjs` (a password field deeper than the scan reaches blacks the window out), `test/chrome-popup-live.mjs` and `test/chrome-mcp-live.mjs` (through @@ -43,6 +43,19 @@ The screenshot note names each window's own reason, `secure-rects` returns them which helper it runs. The Chrome tests say `SPRUNGET OVER` - proved nothing - when the screen is locked, instead of passing. +**Password managers inside a browser are kept out, like the native ones.** Once Chrome +pages were readable, so were 1Password's and Bitwarden's popups, web vaults and Chrome's +own password page. Now a web area whose address is the browser's password page, a known +web vault (1Password, Bitwarden, LastPass, Dashlane, Proton Pass, Keeper, NordPass, +RoboForm, Google Passwords) or one of twelve known password-manager extensions - each id +checked against Chrome Web Store on 5 Nov - is never returned by `computer_find`, +`computer_inspect` or `computer_focused` (the answer says what was left out), its window +is blacked out whole in screenshots, and typing there is refused. The check sits on the +web area, not the window, so a suggestion menu inside another page is covered too, and +it applies in any browser that exposes the address. Not covered: self-hosted vaults, +unlisted extensions (the current NordPass extension's id could not be confirmed) and +screen recordings. Test: `test/chrome-vault-live.mjs` against Chrome's own password page. + **The screen without a question, if you want it.** Set `CMCP_SCREEN_ASK=0` and an agent that needs the screen borrows it with no question and no Touch ID - at once, or eight seconds after another agent's loan ends, so the one before has had time to stop diff --git a/README.md b/README.md index 3b01c01b..1c07a084 100644 --- a/README.md +++ b/README.md @@ -521,11 +521,16 @@ sit unnoticed until it expires. That is a real limitation today, not a setting. until it quits, which costs memory and CPU in Chrome (not measured separately - Chrome's own memory swung ±500 MB in 30 s); Chrome's windows may animate when they are moved (the known side effect of this switch, not measured on Chrome); - any call that looks at Chrome switches it on, not only screenshots; and - password managers that run INSIDE Chrome - an extension's popup, a web vault, - Chrome's own password page - can now be read as text by `computer_find` and - `computer_inspect`, where before only their pixels were in a screenshot. Native - password managers are blacked out whole as before; these are not on that list. + any call that looks at Chrome switches it on, not only screenshots. Password + managers that run INSIDE a browser are treated like the native ones: a page whose + address is Chrome's own password page, a known web vault (1Password, Bitwarden, + LastPass, Dashlane, Proton Pass, Keeper, NordPass, RoboForm, Google Passwords) or + one of twelve known password-manager extensions - also as a suggestion menu + inside another page - is never returned by `computer_find`, `computer_inspect` or + `computer_focused`, the window is blacked out whole in screenshots, and typing + there is refused. Not covered: a self-hosted vault, an extension not on the list + (the current NordPass extension's id could not be confirmed), and screen + recordings, which leave out apps, not pages. `CMCP_INGEN_ELECTRON=1` leaves Chrome's switch off too. And Chrome blocks every extension on Chrome Web Store and its developer console ("The extensions gallery cannot be scripted") - there a browser tool can navigate but not act, and this diff --git a/docs/llms.txt b/docs/llms.txt index f438223d..a81dcbd9 100644 --- a/docs/llms.txt +++ b/docs/llms.txt @@ -112,10 +112,13 @@ under a friendlier name. editor or a token in a terminal buffer is not marked and will not be hidden. - Chrome pages: only Google Chrome is measured; Chrome app windows (PWAs) and unnamed Chromium browsers are not covered. A login inside a cross-site iframe - can be missing from the tree while it shows. Password managers that run inside - Chrome (extension popups, web vaults, Chrome's own password page) can be read - as text. CMCP_INGEN_ELECTRON=1 switches Chrome pages off too, and then their - password fields are not blacked out. + can be missing from the tree while it shows. Password managers inside a browser + (Chrome's own password page, known web vaults, twelve known extensions - also as + a suggestion menu in another page) are never returned by find, inspect or focused, + and their window is blacked out whole; a self-hosted vault or an unlisted + extension is not recognised, and screen recordings leave out apps, not pages. + CMCP_INGEN_ELECTRON=1 switches Chrome pages off too, and then their password + fields are not blacked out. - Consent is not containment; after approval the agent drives the real Mac. For containment, use a virtual machine. - Prompt injection stays possible; the dialogs and log make it visible, not diff --git a/docs/security.html b/docs/security.html index 718917e7..a7a739d8 100644 --- a/docs/security.html +++ b/docs/security.html @@ -199,7 +199,7 @@

Gate 1 - redaction happens before the file exists

Had we written the file first and redacted after, there would be a window - short, but real - where an unredacted picture of your desktop sat on disk for any other process to read. A security property with a race in it is not a security property.

Two things get painted:

    -
  • Secure text fields. Native fields expose the role AXSecureTextField. Fields in a web page expose the role AXTextField with the subrole AXSecureTextField. Checking only the role catches native fields and lets every browser password box through - which is the case that actually matters. We check both. A field in a web page is only visible once the browser shows its page to the accessibility layer: in Chrome this server switches that on (the switch a screen reader uses), and while a Chrome window's page is not readable yet - still being built, 3 to 15 seconds after it is first switched on, measured on Chrome 156, or empty - the whole window is painted over instead. Not covered: Safari, Firefox, Chromium browsers we do not name, Chrome app windows, and any browser when CMCP_INGEN_ELECTRON=1 is set. Known gaps, not measured: a field in a cross-site frame, or a login step that appears before Chrome has updated its tree. Password managers that run inside Chrome are readable as text by the reading tools; native ones are blacked out whole.
    • +
  • Secure text fields. Native fields expose the role AXSecureTextField. Fields in a web page expose the role AXTextField with the subrole AXSecureTextField. Checking only the role catches native fields and lets every browser password box through - which is the case that actually matters. We check both. A field in a web page is only visible once the browser shows its page to the accessibility layer: in Chrome this server switches that on (the switch a screen reader uses), and while a Chrome window's page is not readable yet - still being built, 3 to 15 seconds after it is first switched on, measured on Chrome 156, or empty - the whole window is painted over instead. Not covered: Safari, Firefox, Chromium browsers we do not name, Chrome app windows, and any browser when CMCP_INGEN_ELECTRON=1 is set. Known gaps, not measured: a field in a cross-site frame, or a login step that appears before Chrome has updated its tree. Password managers inside a browser are treated like native ones: a page whose address is the browser's own password page, a known web vault or one of twelve known password-manager extensions (also as a suggestion menu inside another page) is never returned by the reading tools, its window is blacked out whole, and typing there is refused. A self-hosted vault or an unlisted extension is not recognised.
  • Whole windows of listed apps. Keychain Access, 1Password, Bitwarden, LastPass, Dashlane, Apple Passwords. We do not walk into those windows to decide what to hide; descending into a vault to work out what is secret is the mistake we are avoiding.

The rectangles are painted solid black, not blurred or pixelated. A good enough model can read through pixelation. It cannot read through black.

diff --git a/helper/Sources/cmcp-helper/Accessibility.swift b/helper/Sources/cmcp-helper/Accessibility.swift index f78d5147..3f4c07cd 100644 --- a/helper/Sources/cmcp-helper/Accessibility.swift +++ b/helper/Sources/cmcp-helper/Accessibility.swift @@ -598,8 +598,11 @@ enum AX { } static func fokusErSikkert(pid: pid_t?) -> Bool? { + // Vault-porten (5/11): et felt inde i en adgangskode-side behandles som et kodeordsfelt - + // computer_type og indsaet skriver ikke der. guard let pid else { guard let f = focused() else { return nil } + if iVaultSide(f.el) != nil { return true } return sikkerStatus(f.el) } let app = AXUIElementCreateApplication(pid) @@ -609,6 +612,7 @@ enum AX { let raw = r, CFGetTypeID(raw) == AXUIElementGetTypeID() else { return nil } // swiftlint:disable:next force_cast let el = raw as! AXUIElement + if iVaultSide(el) != nil { return true } return sikkerStatus(el) } @@ -650,6 +654,12 @@ enum AX { } guard let el else { return nil } let role = string(el, kAXRoleAttribute as String) ?? "" + // Vault-porten (5/11): staar fokus inde i en adgangskode-side, siges kun DET - og feltet behandles + // som sikkert, saa computer_type afviser at skrive der. + if let g = iVaultSide(el) { + return (el, ["role": role, "secure": true, "denied": true, + "note": "The focus is inside \(g); nothing from it is returned."]) + } var d: [String: Any] = ["role": role, "secure": isSecure(el, role: role)] if let sub = string(el, kAXSubroleAttribute as String), !sub.isEmpty { d["subrole"] = sub } if let t = string(el, kAXTitleAttribute as String), !t.isEmpty { d["title"] = t } @@ -702,6 +712,89 @@ enum AX { return defaultDenyBundles.union(ekstra).contains { $0.lowercased() == bid } } + // MARK: - Adgangskode-sider INDE i en browser (vault-porten, 5/11-2026) + // + // ⛔ R1+R2 (Opus Q2.5/Q4, Astra Q4): da Chrome-sider blev laeselige, blev ogsaa 1Password- og Bitwarden- + // popups, web-hvaelv og Chromes egen kodeordsside laeselige SOM TEKST. Afvisningslisten ovenfor kender + // kun programmer, og «Chrome» paa den ville slukke alle sider. Gustav 5/11: «kør e2e også password + // programmer i chrome». Porten sidder paa WEB-OMRAADET (AXWebArea), ikke vinduet: Bitwardens og + // 1Passwords forslagsmenuer er indlejrede rammer (chrome-extension://...) inde i almindelige sider. + // Adressen er metadata, ikke indhold - vi laeser den for at vide hvad vi IKKE maa laese. + + /// Udvidelses-id'er, hver slaaet op i Chrome Web Store 5/11-2026 (sidens titel i parentes). + static let vaultUdvidelser: Set = [ + "aeblfdkhhhdcdjpifhhbdiojplfjncoa", // 1Password – Password Manager + "nngceckbapebfimnlniiiahkandclblb", // Bitwarden Password Manager + "hdokiejnpimakedhajhdlcegeplioahd", // LastPass: Free Password Manager + "fdjamakpfbbddfjaooikfcpapjohcfmg", // Dashlane — Password Manager + "ghmbeldphafepmbegfdlkpapadhbakde", // Proton Pass: Free Password Manager + "bfogiafebfohielmmehodmfbbebbbpei", // Keeper® Password Manager & Digital Vault + "fooolghllnmhmmndgjiamiiodkpenpbb", // NordPass® (legacy) - den nye udgaves id kunne ikke bekraeftes + "pnlccmojcmeohlpggmfnbbiapkmbliob", // RoboForm Password Manager + "kmcfomidfpdkfieipokbalgegidffkal", // Enpass Password Manager + "pejdijmoenmkgeppbflobdenhhabjlaj", // iCloud Passwords + "admmjipmmciaobhojoghlmleefbicajg", // Norton Password Manager + "caljgklbbfbcjjanaijlacgncafpegll", // Avira Password Manager + ] + /// Browserens egne kodeordssider (adresserne er ens paa alle sprog). + static let vaultInterne = ["chrome://password-manager", "chrome://settings/passwords", + "edge://wallet", "edge://settings/passwords", "brave://password-manager", + "brave://settings/passwords", "opera://settings/passwords", "vivaldi://settings/passwords"] + /// Web-hvaelv: vaerter der ALTID er et hvaelv (hver svarede 5/11; Dashlane 403 = bot-vaern, siden findes). + static let vaultVaerter: Set = ["vault.bitwarden.com", "vault.bitwarden.eu", "app.dashlane.com", "pass.proton.me", + "app.nordpass.com", "passwords.google.com", "online.roboform.com"] + /// 1Password: holdets egen undervaert (agent360.1password.eu) - undtagen markedsfoering og hjaelp. + static let enPasswordIkkeHvaelv: Set = ["", "www", "support", "blog", "developer", "releases", "status", "community"] + + static func erVaultAdresse(_ url: String) -> Bool { + let lav = url.lowercased() + if vaultInterne.contains(where: { lav.hasPrefix($0) }) { return true } + if lav.hasPrefix("chrome-extension://") { + return vaultUdvidelser.contains(String(lav.dropFirst("chrome-extension://".count).prefix(32))) + } + guard let u = URL(string: url), let vaert = u.host?.lowercased() else { return false } + let sti = u.path.lowercased() + if vaultVaerter.contains(vaert) { return true } + let udenWww = vaert.hasPrefix("www.") ? String(vaert.dropFirst(4)) : vaert + if ["lastpass.com", "lastpass.eu", "keepersecurity.com", "keepersecurity.eu"].contains(udenWww), sti.hasPrefix("/vault") { return true } + for d in [".1password.com", ".1password.eu", ".1password.ca"] where vaert.hasSuffix(d) { + return !enPasswordIkkeHvaelv.contains(String(vaert.dropLast(d.count))) + } + return false + } + + /// Adressen paa et web-omraade (AXURL er en CFURL; nogle browsere giver en streng). + static func webAdresse(_ el: AXUIElement) -> String? { + guard let v = attr(el, "AXURL") else { return nil } + if CFGetTypeID(v) == CFURLGetTypeID() { return (v as! URL).absoluteString } + return v as? String + } + + /// Navne der kun bruges, naar et web-omraades adresse IKKE kan laeses (saa ved vi ikke - og gaetter lukket). + static let vaultNavne = ["1password", "bitwarden", "lastpass", "dashlane", "proton pass", "keeper", "nordpass", + "roboform", "enpass", "password manager", "adgangskodeadministrator"] + + /// Ligger elementet (eller et af dets forfaedre) i en adgangskode-side? Svarer grunden, ellers nil. + /// Bruges af alt der skriver eller svarer om FOKUS: computer_type, indsaet, set_value uden maal, focused. + static func iVaultSide(_ el: AXUIElement) -> String? { + var op: AXUIElement? = el + for _ in 0..<80 { + guard let cur = op else { return nil } + if let g = vaultGrund(cur, rolle: string(cur, kAXRoleAttribute as String) ?? "") { return g } + guard let p = attr(cur, kAXParentAttribute as String), CFGetTypeID(p) == AXUIElementGetTypeID() else { return nil } + op = (p as! AXUIElement) + } + return nil + } + + /// Er dette element et web-omraade med en adgangskode-side? Svarer grunden, ellers nil. + static func vaultGrund(_ el: AXUIElement, rolle: String) -> String? { + guard rolle == "AXWebArea" else { return nil } + if let u = webAdresse(el) { return erVaultAdresse(u) ? "a password manager page" : nil } + let titel = (string(el, kAXTitleAttribute as String) ?? "").lowercased() + return vaultNavne.contains(where: { titel.contains($0) }) ? "a page that looks like a password manager (its address could not be read)" : nil + } + /// Find alle rektangler der skal sloeres. Dybden er bevidst begraenset: /// et AX-trae kan vaere uendeligt i en web-visning, og en hjaelper der /// haenger, er en hjaelper der fejler aabent. @@ -718,6 +811,8 @@ enum AX { /// Loeber tiden alligevel ud, sloerer vi HELE det program vi ikke naaede /// - aldrig et billede med et ugennemgaaet vindue paa. static var sloeringStoppede: [String] = [] + /// Adgangskode-sider som `find` sprang over i dette kald (vault-porten). + static var vaultSprunget: [String] = [] static func secureRects(scopeBundleId: String?, extraDeny: Set, maxDepth: Int = 40, indenfor: Rect? = nil) -> [Rect] { @@ -898,10 +993,20 @@ enum AX { gennemgangFrist = start.addingTimeInterval(tidsgraense) gennemgangOverskred = false dybdeRamt = false + var vaultHer: String? = nil walk(win, depth: 0, maxDepth: maxDepth) { el, role in if isSecure(el, role: role), let f = frame(el) { out.append(f) } + if vaultHer == nil, let g = vaultGrund(el, rolle: role) { vaultHer = g } } gennemgangFrist = nil + // Vault-porten (5/11): en adgangskode-side et sted i vinduet - ogsaa en indlejret forslagsmenu - + // og hele vinduet ud. Gaelder alle programmer med web-omraader, ikke kun Chrome. + if let g = vaultHer { + let hele = frame(win).map { [$0] } ?? cgRammer(pid: app.processIdentifier) + out.append(contentsOf: hele.isEmpty ? [indenfor ?? heleSkaermen()] : hele) + sloeringStoppede.append((app.localizedName ?? bid) + " (\(g) - window blacked out whole)") + continue + } // ⛔ REVIEW 5/11 (Opus, F5) - og MAALT: et kodefelt under 45 indlejrede grupper laa dybere end // loftet (40), blev ikke fundet, og vinduet blev ikke svaertet: 0 rektangler. Et opslag der // loeb toer for tid giver ogsaa et tomt svar i stilhed. I Chrome-sider kan vi derfor ikke @@ -1023,6 +1128,13 @@ enum AX { guard besoegt.insert(el).inserted else { continue } guard d < maxDepth else { continue } let role = string(el, kAXRoleAttribute as String) ?? "" + // Vault-porten (5/11): kun AT der er en adgangskode-side - aldrig hvad der staar paa den. + if let g = vaultGrund(el, rolle: role) { + nodes.append(["app": app.localizedName ?? "", "bundleId": app.bundleIdentifier ?? "", + "role": role, "depth": d, "denied": true, + "note": "This is \(g). Like a password manager app, its content is not returned, and screenshots black its window out."]) + continue + } let isSecure = isSecure(el, role: role) var n: [String: Any] = [ "app": app.localizedName ?? "", @@ -1090,6 +1202,7 @@ extension AX { var out: [Match] = [] let start = Date() stoppedeTidligt = false + vaultSprunget = [] let wantRole = role?.lowercased() let wantTitle = title?.lowercased() let wantContains = contains?.lowercased() @@ -1142,9 +1255,11 @@ extension AX { // - altsaa det SIDSTE element i laeseretning. En agent der bad // om «den foerste Gem-knap» trykkede den sidste. // Det ramte skrivende kald, ikke kun visningen. + let r = string(el, kAXRoleAttribute as String) ?? "" + // Vault-porten (5/11): intet fra en adgangskode-side - hverken den eller noget under den. + if let g = vaultGrund(el, rolle: r) { vaultSprunget.append("\(app.localizedName ?? ""): \(g)"); continue } for c in children(el).reversed() { stack.append((c, d + 1)) } - let r = string(el, kAXRoleAttribute as String) ?? "" if let wr = wantRole, r.lowercased() != wr, "ax" + wr != r.lowercased() { continue } if let ws = wantSubrole { let sr = (string(el, kAXSubroleAttribute as String) ?? "").lowercased() diff --git a/helper/Sources/cmcp-helper/main.swift b/helper/Sources/cmcp-helper/main.swift index f818a4a5..fcb597e3 100644 --- a/helper/Sources/cmcp-helper/main.swift +++ b/helper/Sources/cmcp-helper/main.swift @@ -509,10 +509,15 @@ case "find": ekstraDeny: denySet(args) ) var fundSvar: [String: Any] = ["matches": hits.map(\.dict), "count": hits.count] + // Vault-porten (5/11): sig AT en adgangskode-side blev sprunget over, saa et tomt svar ikke laeses som «findes ikke». + if !AX.vaultSprunget.isEmpty { + fundSvar["skipped_password_pages"] = Array(Set(AX.vaultSprunget)).sorted() + fundSvar["note"] = "Password manager pages were not searched (\(Set(AX.vaultSprunget).count)) - like password manager apps, their content is never returned." + } // ⛔ R23 (Astra): et tidsudloeb lignede et tomt program ({count: 0}). Nu siges det. if AX.stoppedeTidligt { fundSvar["stopped_early"] = true - fundSvar["note"] = "The search stopped after \(Int(AX.tidsgraense)) seconds - this app answers slowly, so these are the matches in PART of it, not all. Narrow it with role, subrole, title or a lower depth." + fundSvar["note"] = [fundSvar["note"] as? String, "The search stopped after \(Int(AX.tidsgraense)) seconds - this app answers slowly, so these are the matches in PART of it, not all. Narrow it with role, subrole, title or a lower depth."].compactMap { $0 }.joined(separator: " ") } // ⛔ MAALT 4/11: kaldet der taendte Chromes web-trae, saa 0 - traeet kom 3-15 s senere. if hits.isEmpty && (AX.chromeTaendtNu || AX.chromeSideUlaeselig(scope: args.str("app"))) { @@ -577,7 +582,9 @@ case "set-value": let role = (t.dict["role"] as? String) ?? "" // R24 (Astra): paa FOKUS-vejen kan macOS' adgangskodesignal se et felt AX ikke kan. - if AX.isSecure(t.el, role: role) || (fokusVej && skriveDom(fokusSikkert: false, sikkerIndtastning: macosSikkerIndtastning()) == .sikkertFelt) { + // Vault-porten (5/11): paa fokus-vejen kan feltet ligge i en adgangskode-side; find springer dem over, fokus goer ikke. + if AX.isSecure(t.el, role: role) || (fokusVej && AX.iVaultSide(t.el) != nil) + || (fokusVej && skriveDom(fokusSikkert: false, sikkerIndtastning: macosSikkerIndtastning()) == .sikkertFelt) { Out.fail("this is a secure field - we do not write into password fields. Ask the person to type it themselves with computer_ask_user.", code: "secure-field", extra: ["element": t.dict]) } diff --git a/mcp-server/README.md b/mcp-server/README.md index 932f54f6..eaa4a96c 100644 --- a/mcp-server/README.md +++ b/mcp-server/README.md @@ -519,11 +519,16 @@ sit unnoticed until it expires. That is a real limitation today, not a setting. until it quits, which costs memory and CPU in Chrome (not measured separately - Chrome's own memory swung ±500 MB in 30 s); Chrome's windows may animate when they are moved (the known side effect of this switch, not measured on Chrome); - any call that looks at Chrome switches it on, not only screenshots; and - password managers that run INSIDE Chrome - an extension's popup, a web vault, - Chrome's own password page - can now be read as text by `computer_find` and - `computer_inspect`, where before only their pixels were in a screenshot. Native - password managers are blacked out whole as before; these are not on that list. + any call that looks at Chrome switches it on, not only screenshots. Password + managers that run INSIDE a browser are treated like the native ones: a page whose + address is Chrome's own password page, a known web vault (1Password, Bitwarden, + LastPass, Dashlane, Proton Pass, Keeper, NordPass, RoboForm, Google Passwords) or + one of twelve known password-manager extensions - also as a suggestion menu + inside another page - is never returned by `computer_find`, `computer_inspect` or + `computer_focused`, the window is blacked out whole in screenshots, and typing + there is refused. Not covered: a self-hosted vault, an extension not on the list + (the current NordPass extension's id could not be confirmed), and screen + recordings, which leave out apps, not pages. `CMCP_INGEN_ELECTRON=1` leaves Chrome's switch off too. And Chrome blocks every extension on Chrome Web Store and its developer console ("The extensions gallery cannot be scripted") - there a browser tool can navigate but not act, and this diff --git a/mcp-server/index.js b/mcp-server/index.js index d008acc0..5bd8dffb 100644 --- a/mcp-server/index.js +++ b/mcp-server/index.js @@ -272,8 +272,10 @@ that content in the background the first time it is asked, which takes 3 to 15 seconds; a search that finds nothing while a Chrome page is not readable yet says so (\`tree_building\`), and until it is built, that Chrome window is blacked out whole in screenshots. Read again before you conclude a page is empty. Password -managers that run inside Chrome (an extension popup, a web vault) are readable as -text here - do not read them unless the person asked you to. +managers inside a browser (Chrome's own password page, a known web vault or +password-manager extension) are never returned, like the native apps: an answer +that says skipped_password_pages or denied left one out on purpose - do not try to +read it another way, and ask the person if you need something from it. When a browser tool is also in this session (Browser MCP's browser_*), let it do the work inside pages, and take over where it is refused: Chrome blocks EVERY extension on Chrome Web Store and its developer console ("The extensions gallery diff --git a/test/chrome-vault-live.mjs b/test/chrome-vault-live.mjs new file mode 100644 index 00000000..3ed8df22 --- /dev/null +++ b/test/chrome-vault-live.mjs @@ -0,0 +1,95 @@ +// Vault-porten: en adgangskode-side INDE i Chrome laeses ikke som tekst og svaertes helt. +// +// Gustav 5/11: «kør e2e også password programmer i chrome». Chromes egen kodeordsside (chrome://password-manager) +// er en aegte vault-side - i en engangs-profil er den tom, men den har et soegefelt og knapper. +// +// 1. naar siden er bygget, svaertes HELE vinduet - af grunden «password manager page» +// 2. find giver INTET tekstfelt fra siden, og svaret siger at en adgangskode-side blev sprunget over +// 3. inspect afleverer kun en «denied»-markering for siden +// +// Koeres bevidst: `node test/chrome-vault-live.mjs`. Roerer hverken mus eller tastatur; kun naar personen er inaktiv. +import { execFileSync } from 'node:child_process'; +import { startChrome, inaktivSek, MIN_INAKTIV } from './chrome-start.mjs'; +import { existsSync, mkdtempSync, rmSync } from 'node:fs'; +import { tmpdir } from 'node:os'; +import { join, dirname } from 'node:path'; +import { fileURLToPath } from 'node:url'; + +const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..'); +const H = process.env.CMCP_HELPER || join(ROOT, 'mcp-server', 'vendor', 'cmcp-helper'); +const N = 5; +if (!existsSync('/Applications/Google Chrome.app')) { console.log(`SPRUNGET OVER: ${N} (Google Chrome er ikke installeret her) - bevist intet, ikke bestaaet`); process.exit(0); } +{ + const io = execFileSync('ioreg', ['-n', 'Root', '-d1'], { encoding: 'utf8' }); + if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) { console.log(`SPRUNGET OVER: ${N} (skaermen er laast - Chrome bygger ingen sider imens) - bevist intet, ikke bestaaet`); process.exit(0); } +} +if (inaktivSek() < MIN_INAKTIV) { console.log(`SPRUNGET OVER: ${N} (personen arbejder lige nu - inaktiv ${Math.round(inaktivSek())} s; en ny Chrome henter sig selv frem foran dem) - bevist intet, ikke bestaaet`); process.exit(0); } + +let fejl = 0; +const check = (navn, ok, hvorfor) => { console.log(`${ok ? 'OK ' : 'DUMP'} ${navn}${ok ? '' : ' - ' + hvorfor}`); if (!ok) fejl++; }; +const hj = (args, env) => JSON.parse(execFileSync(H, args, { encoding: 'utf8', timeout: 60000, maxBuffer: 64 * 1024 * 1024, env: env ? { ...process.env, ...env } : process.env })); +const vent = (ms) => new Promise((r) => setTimeout(r, ms)); + +const V = { x: 120, y: 110, w: 820, h: 600 }; +const iV = (r) => r.x >= V.x - 4 && r.y >= V.y - 4 && r.x + r.w <= V.x + V.w + 4 && r.y + r.h <= V.y + V.h + 4; +const heleV = (r) => Math.abs(r.w - V.w) <= 8 && Math.abs(r.h - V.h) <= 8; +// Sidens omraade: under fanelinje og vaerktoejslinje. +const iSiden = (f) => f && f.x >= V.x && f.x + f.w <= V.x + V.w + 4 && f.y >= V.y + 90 && f.y + f.h <= V.y + V.h + 4; + +// ⛔ find/inspect uden soegeord ser OGSAA personens egne Chrome-vinduer. Et geometri-filter alene ville +// taelle deres felter med (falsk roedt) og skrive deres navne i bevisfilen. Derfor et oejebliksbillede +// FOER proevens Chrome starter, og kun FORSKELLEN maales. Intet fra personens vinduer udskrives. +const noegle = (x) => `${x.role}|${x.name || x.title || ''}|${x.value || ''}|${JSON.stringify(x.frame || {})}`; +const findFelter = () => (hj(['find', '--app', 'com.google.Chrome', '--role', 'AXTextField', '--depth', '60', '--limit', '400']).matches || []); +const inspektion = () => hj(['inspect', '--app', 'com.google.Chrome', '--depth', '14', '--limit', '4000']).nodes || []; +const foerFind = new Set(findFelter().map(noegle)); +const foerIns = new Set(inspektion().map(noegle)); + +const mappe = mkdtempSync(join(tmpdir(), 'cmcp-chrome-vault-')); +const chrome = await startChrome([`--user-data-dir=${join(mappe, 'profil')}`, '--no-first-run', '--no-default-browser-check', + '--disable-extensions', '--disable-session-crashed-bubble', `--window-position=${V.x},${V.y}`, `--window-size=${V.w},${V.h}`, + 'chrome://password-manager/passwords']); +const ryd = () => { chrome.stop(); try { rmSync(mappe, { recursive: true, force: true }); } catch {} }; +process.on('exit', ryd); + +try { + // Vent paa vinduet (dets ramme, Chromes egen brugerflade) UDEN at taende traeet. + let set = false; + for (let i = 0; i < 40 && !set; i++) { + await vent(250); + const w = hj(['find', '--app', 'com.google.Chrome', '--role', 'AXWindow', '--depth', '2'], { CMCP_INGEN_ELECTRON: '1' }); + set = (w.matches || []).some((m) => m.frame && heleV(m.frame) && iV(m.frame)); + } + check('0. test-vinduet med kodeordssiden er aabnet', set, 'intet vindue med den ramme paa 10 s'); + + // 1. Naar siden er bygget: hele vinduet ud, af vault-grunden. + let sr = { rects: [], whole_window: [] }; + for (let i = 0; i < 60; i++) { + sr = hj(['secure-rects', '--app', 'com.google.Chrome']); + if ((sr.whole_window || []).some((g) => /password manager page/.test(g))) break; + await vent(500); + } + check('1. vinduet svaertes HELT, af grunden «password manager page»', + sr.rects.filter(iV).some(heleV) && (sr.whole_window || []).some((g) => /password manager page/.test(g)), + `rekt ${JSON.stringify(sr.rects.filter(iV))} grunde ${JSON.stringify(sr.whole_window)}`); + + // 2. find: intet tekstfelt fra siden (kodeordssiden har et soegefelt), og svaret siger hvorfor. + const f = hj(['find', '--app', 'com.google.Chrome', '--role', 'AXTextField', '--depth', '60', '--limit', '400']); + const fraSiden = (f.matches || []).filter((m) => iSiden(m.frame) && !foerFind.has(noegle(m))); + check('2. find giver intet felt fra kodeordssiden, og siger at den blev sprunget over', + fraSiden.length === 0 && (f.skipped_password_pages || []).length > 0, + `fra siden: ${JSON.stringify(fraSiden.map((m) => m.name || m.role))} sprunget: ${JSON.stringify(f.skipped_password_pages)}`); + + // 3. inspect: kun en «denied»-markering for siden. + const ins = inspektion(); + const naegtet = ins.filter((n) => n.denied && n.role === 'AXWebArea' && /password manager page/.test(n.note || '')); + const indhold = ins.filter((n) => !n.denied && iSiden(n.frame) && (n.value || n.title) && !foerIns.has(noegle(n))); + check('3. inspect giver en «denied»-markering og intet indhold fra siden', + naegtet.length > 0 && indhold.length === 0, + `naegtet ${naegtet.length}, indhold fra siden: ${JSON.stringify(indhold.slice(0, 5).map((n) => n.title || n.value))}`); +} finally { + check('Z. proevens Chrome er lukket igen', chrome.stop(), 'den lever stadig'); + ryd(); +} +console.log(fejl ? `\n${fejl} DUMPET` : '\nBESTAAET'); +process.exit(fejl ? 1 : 0); diff --git a/test/claims-offline.mjs b/test/claims-offline.mjs index 0ee31fd0..67d68753 100644 --- a/test/claims-offline.mjs +++ b/test/claims-offline.mjs @@ -197,6 +197,20 @@ check('kontakten kan slaas fra, saa tallet kan efterproeves udefra', // fordi Swift folder dem sammen med systemets egne konstanter. En vagt // bygget paa alle kildens navne ville lyse roedt paa noget der virker. // Derfor: kun de navne der baerer et LOEFTE vi giver offentligt. +// Vault-porten (5/11): de tolv udvidelses-id'er blev hver slaaet op i Chrome Web Store. Et id der falder ud +// af listen ved en fejl, aabner porten for netop den adgangskode-udvidelse. +{ + const ids = ['aeblfdkhhhdcdjpifhhbdiojplfjncoa', 'nngceckbapebfimnlniiiahkandclblb', 'hdokiejnpimakedhajhdlcegeplioahd', + 'fdjamakpfbbddfjaooikfcpapjohcfmg', 'ghmbeldphafepmbegfdlkpapadhbakde', 'bfogiafebfohielmmehodmfbbebbbpei', + 'fooolghllnmhmmndgjiamiiodkpenpbb', 'pnlccmojcmeohlpggmfnbbiapkmbliob', 'kmcfomidfpdkfieipokbalgegidffkal', + 'pejdijmoenmkgeppbflobdenhhabjlaj', 'admmjipmmciaobhojoghlmleefbicajg', 'caljgklbbfbcjjanaijlacgncafpegll']; + const liste = sw.slice(sw.indexOf('static let vaultUdvidelser'), sw.indexOf(']', sw.indexOf('static let vaultUdvidelser'))); + const mangler = ids.filter((i) => !liste.includes(`"${i}"`)); + check('vault-porten: alle tolv bekraeftede udvidelses-id\'er staar i listen', mangler.length === 0, `mangler ${mangler.join(', ')}`); + check('vault-porten: find, inspect, focused og fokus-skrivning spoerger alle', /vaultGrund\(el, rolle: r\)/.test(sw) + && /vaultGrund\(el, rolle: role\)/.test(sw) && (sw.match(/iVaultSide\(/g) || []).length >= 4, 'en af vejene mangler'); +} + const LOEFTER = [ ['AXManualAccessibility', 'virker inde i Electron-programmer'], ['AXSecureTextField', 'kodeordsfelter kan findes og sloeres'], @@ -207,6 +221,8 @@ const LOEFTER = [ // R2 5/11 (Opus N11): evnen en chat spoerger efter med `version` - og grundene secure-rects nu giver. // Navnet er over 15 tegn: kortere Swift-strenge ligger i koden og kan ikke findes her (maalt 5/11). ['chrome-page-redaction', 'siger selv at den kan Chrome-sider (version)'], + // Vault-porten 5/11: et id fra listen (32 tegn, ligger i strengtabellen) - en binaer uden porten kan ikke bestaa. + ['nngceckbapebfimnlniiiahkandclblb', 'adgangskode-sider i browsere holdes ude (vault-porten)'], ]; const BIN = join(ROOT, 'mcp-server', 'vendor', 'cmcp-helper'); let raa = null; diff --git a/test/run-all.sh b/test/run-all.sh index fc634fb0..6372c3ba 100755 --- a/test/run-all.sh +++ b/test/run-all.sh @@ -140,6 +140,7 @@ run "chrome-sider" "node test/chrome-side-live.mjs" run "chrome dyb side" "node test/chrome-dyb-side-live.mjs" run "chrome via server" "node test/chrome-mcp-live.mjs" run "chrome popup" "node test/chrome-popup-live.mjs" +run "chrome vault" "node test/chrome-vault-live.mjs" run "sloeringens grund" "node test/redaction-note.mjs" run "menuvagt" "node test/menu-vagt.mjs" run "genaabn" "node test/genaabn.mjs" From bf278ccdeada02a08f1d3dad94a14b4f9bc3888d Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Thu, 5 Nov 2026 09:06:36 +0100 Subject: [PATCH 48/94] Efter R3 (Astra, IKKE GODKENDT): alle store Chrome-vinduer gennem porten, fristerne begge veje, M4/M6 bundet MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Et popup med anden underrolle, hvis web-omraade endnu ikke var oprettet, slap igennem. Nu gaar ethvert Chromium-vindue paa mindst 200x120 gennem porten uanset underrolle; prisen (Chromes store bobler svaertes mens de er aabne) er valgt og staar i noten. - Fristen tjekkes foer OG efter hvert opslag i harWebIndhold; et sent svar i harWebOmraade og chromeSideUlaeselig er ikke et «nej». - chrome-lille-popup-live.mjs: to smaa popups, saa netop «lige taendt» (M4) og «har et web-omraade» (M6) er de eneste regler der kan svaerte dem. - run-all skriver SPRUNGET OVER, ikke BESTAAET, for en proeve der intet maalte. - README/CHANGELOG: mutations- og «hvert vindue»-paastandene indsnaevret til det maalte. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 6 +- README.md | 5 +- .../Sources/cmcp-helper/Accessibility.swift | 22 +++-- mcp-server/README.md | 5 +- test/chrome-lille-popup-live.mjs | 84 +++++++++++++++++++ test/claims-offline.mjs | 2 +- test/run-all.sh | 7 +- 7 files changed, 116 insertions(+), 15 deletions(-) create mode 100644 test/chrome-lille-popup-live.mjs diff --git a/CHANGELOG.md b/CHANGELOG.md index e1c5a78c..dac43f69 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -37,8 +37,10 @@ After a second review (two reviewers, 5 Nov) the gate fails closed in more place Chrome window passes only when the search for its pages reached the end and no lookup answered "don't know" (a timeout, an element Chrome rebuilt mid-scan, a failure); a window with a web area needs content whatever its role, so an extension popup is -covered; and the call that switches Chrome on blacks out all of that Chrome's windows. -The screenshot note names each window's own reason, `secure-rects` returns them +covered; every Chrome window of at least 200x120 goes through the gate whatever its +role, so Chrome's own large bubbles are blacked out while they are open (said in the +note); and on the call that switches Chrome on, small windows go through it too. The +screenshot note names the reasons per app, `secure-rects` returns them (`whole_window`), and `version` lists `chrome-page-redaction`, so an agent can tell which helper it runs. The Chrome tests say `SPRUNGET OVER` - proved nothing - when the screen is locked, instead of passing. diff --git a/README.md b/README.md index 1c07a084..7fc1af97 100644 --- a/README.md +++ b/README.md @@ -162,8 +162,9 @@ and that its chain holds. ``` -Each gate has a test, and each test has been mutation-checked: break the code on -purpose and the test goes red. See [Testing](#testing). +Each gate has a test, and the tests were mutation-checked when they were written: +break the code on purpose and the test goes red. Where a mutant survives, the +CHANGELOG says which and why. See [Testing](#testing). ## Install diff --git a/helper/Sources/cmcp-helper/Accessibility.swift b/helper/Sources/cmcp-helper/Accessibility.swift index 3f4c07cd..567bd527 100644 --- a/helper/Sources/cmcp-helper/Accessibility.swift +++ b/helper/Sources/cmcp-helper/Accessibility.swift @@ -161,7 +161,8 @@ enum AX { lag = naeste } guard fuldstaendig, !omraader.isEmpty else { return false } - let alleHarIndhold = omraader.allSatisfy { !children($0).isEmpty } + // R3 (Astra): fristen FOER hvert opslag (ingen ventetid efter fristen) og EFTER (intet sent svar godkendes). + let alleHarIndhold = omraader.allSatisfy { Date() <= frist && !children($0).isEmpty } return alleHarIndhold && Date() <= frist && uvisseOpslag == uvisseFoer } @@ -179,7 +180,8 @@ enum AX { if string(el, kAXRoleAttribute as String) == "AXWebArea" { return true } naeste.append(contentsOf: children(el)) } - if naeste.isEmpty { return uvisseOpslag != uvisseFoer } + // R3 (Astra): et sent svar efter fristen er ikke et «nej». + if naeste.isEmpty { return uvisseOpslag != uvisseFoer || Date() > frist } lag = naeste } return true @@ -206,12 +208,13 @@ enum AX { if Date() > frist { return true } let vf = frame(win), vsub = string(win, kAXSubroleAttribute as String) let sidevindue = vf == nil || vsub == nil - || (vsub == "AXStandardWindow" && vf!.w >= 200 && vf!.h >= 120) - || harWebOmraade(win, frist: frist) // ogsaa en popup med en side (Opus N3) + || (vf!.w >= 200 && vf!.h >= 120) // uanset underrolle (R3, Astra) + || harWebOmraade(win, frist: frist) // ogsaa en lille popup med en side (Opus N3) if sidevindue, !harWebIndhold(win, frist: frist) { return true } } } - return false + // R3 (Astra): et sidste, sent, tomt vinduessvar efter fristen er heller ikke et «alt laesbart». + return Date() > frist } /// Den ene saetning alle laesende svar bruger, naar svaret kan vaere tomt alene fordi @@ -956,8 +959,13 @@ enum AX { // porten over. Nu gaelder porten ogsaa (a) ethvert vindue, naar DETTE kald lige taendte // Chromes trae (saa er intet bygget endnu), og (b) ethvert vindue der HAR et web-omraade. // Chromes egne bobler har intet web-omraade og gennemgaas som foer. + // ⛔ R3 5/11 (Astra): et popup med en anden underrolle, hvis web-omraade endnu ikke er OPRETTET, + // slap igennem (harWebOmraade = false). Nu gaar ethvert vindue paa mindst 200x120 gennem + // porten, uanset underrolle - prisen er at Chromes egne store bobler svaertes mens de er + // aabne (med en aerlig note). Valgt bevidst: over-sloering frem for et hul. Smaa vinduer + // (vaerktoejslinjens strimler) kun hvis de har et web-omraade, eller kaldet lige taendte Chrome. sidevindue = vf == nil || vsub == nil - || (vsub == "AXStandardWindow" && vf!.w >= 200 && vf!.h >= 120) + || (vf!.w >= 200 && vf!.h >= 120) || AX.chromeTaendtNu || AX.harWebOmraade(win, frist: start.addingTimeInterval(tidsgraense)) } @@ -965,7 +973,7 @@ enum AX { let hele = frame(win).map { [$0] } ?? cgRammer(pid: app.processIdentifier) out.append(contentsOf: hele.isEmpty ? [indenfor ?? heleSkaermen()] : hele) if !chromeNoteSat { - sloeringStoppede.append((app.localizedName ?? bid) + " (its page was not readable yet - still being built, or empty - so the window was blacked out whole)") + sloeringStoppede.append((app.localizedName ?? bid) + " (its page could not be checked - still being built, empty, or not fully readable - so the window was blacked out whole)") chromeNoteSat = true } continue diff --git a/mcp-server/README.md b/mcp-server/README.md index eaa4a96c..b8398501 100644 --- a/mcp-server/README.md +++ b/mcp-server/README.md @@ -160,8 +160,9 @@ and that its chain holds. ``` -Each gate has a test, and each test has been mutation-checked: break the code on -purpose and the test goes red. See [Testing](#testing). +Each gate has a test, and the tests were mutation-checked when they were written: +break the code on purpose and the test goes red. Where a mutant survives, the +CHANGELOG says which and why. See [Testing](#testing). ## Install diff --git a/test/chrome-lille-popup-live.mjs b/test/chrome-lille-popup-live.mjs new file mode 100644 index 00000000..3c31c8c5 --- /dev/null +++ b/test/chrome-lille-popup-live.mjs @@ -0,0 +1,84 @@ +// Smaa Chrome-vinduer (under 200x120): de to regler der KUN gaelder dem. +// +// ⛔ R3 5/11 (Astra): M4 («kaldet lige taendte Chrome» slaaet fra) og M6 («har et web-omraade» slaaet fra) +// overlevede, fordi ingen proeve ramte deres veje - store vinduer gaar gennem porten paa stoerrelsen alene. +// Denne proeve aabner to SMAA popups, saa netop de to regler er de eneste der kan svaerte dem: +// +// 1. P1 (med kodefelt), paa det kald der taender Chrome: intet web-omraade endnu -> kun «lige taendt» svaerter +// 2. P2 (en tom side), naar Chrome er taendt: web-omraadet findes, men er tomt -> kun «har et web-omraade» svaerter +// 3. P1, naar siden er bygget: kun kodefeltet, ikke hele vinduet +// +// Giver Chrome vinduerne mindst 200x120, kan vejen ikke naas i praksis - saa siger proeven SPRUNGET OVER. +import { execFileSync } from 'node:child_process'; +import { startChrome, inaktivSek, MIN_INAKTIV } from './chrome-start.mjs'; +import { existsSync, mkdtempSync, writeFileSync, rmSync } from 'node:fs'; +import { tmpdir } from 'node:os'; +import { join, dirname } from 'node:path'; +import { fileURLToPath } from 'node:url'; + +const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..'); +const H = process.env.CMCP_HELPER || join(ROOT, 'mcp-server', 'vendor', 'cmcp-helper'); +const N = 5; +const spring = (grund) => { console.log(`SPRUNGET OVER: ${N} (${grund}) - bevist intet, ikke bestaaet`); process.exit(0); }; +if (!existsSync('/Applications/Google Chrome.app')) spring('Google Chrome er ikke installeret her'); +{ + const io = execFileSync('ioreg', ['-n', 'Root', '-d1'], { encoding: 'utf8' }); + if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) spring('skaermen er laast - Chrome bygger ingen sider imens'); +} +if (inaktivSek() < MIN_INAKTIV) spring(`personen arbejder lige nu - inaktiv ${Math.round(inaktivSek())} s; en ny Chrome henter sig selv frem foran dem`); + +let fejl = 0; +const check = (navn, ok, hvorfor) => { console.log(`${ok ? 'OK ' : 'DUMP'} ${navn}${ok ? '' : ' - ' + hvorfor}`); if (!ok) fejl++; }; +const hj = (args, env) => JSON.parse(execFileSync(H, args, { encoding: 'utf8', timeout: 60000, env: env ? { ...process.env, ...env } : process.env })); +const vent = (ms) => new Promise((r) => setTimeout(r, ms)); +const M = `CMCPLILLE${Date.now().toString(36).toUpperCase()}`; + +const mappe = mkdtempSync(join(tmpdir(), 'cmcp-chrome-lille-')); +writeFileSync(join(mappe, 'p1.html'), `${M}-P1 +`); +writeFileSync(join(mappe, 'p2.html'), `${M}-P2`); +writeFileSync(join(mappe, 'side.html'), `${M}-HOVED`); +const chrome = await startChrome([`--user-data-dir=${join(mappe, 'profil')}`, '--no-first-run', '--no-default-browser-check', + '--disable-extensions', '--disable-popup-blocking', '--disable-session-crashed-bubble', '--window-position=60,90', + '--window-size=520,380', `file://${join(mappe, 'side.html')}`]); +const ryd = () => { chrome.stop(); try { rmSync(mappe, { recursive: true, force: true }); } catch {} }; +process.on('exit', ryd); + +const vindue = (titel) => (hj(['find', '--app', 'com.google.Chrome', '--role', 'AXWindow', '--contains', titel, '--depth', '3'], { CMCP_INGEN_ELECTRON: '1' }).matches || [])[0]; +const helt = (rects, f) => rects.some((r) => Math.abs(r.x - f.x) <= 4 && Math.abs(r.y - f.y) <= 4 && Math.abs(r.w - f.w) <= 6 && Math.abs(r.h - f.h) <= 6); +const inde = (rects, f) => rects.filter((r) => r.x >= f.x - 4 && r.y >= f.y - 4 && r.x + r.w <= f.x + f.w + 4 && r.y + r.h <= f.y + f.h + 4); + +try { + let p1, p2; + for (let i = 0; i < 60 && !(p1 && p2); i++) { await vent(250); p1 = p1 || vindue(`${M}-P1`); p2 = p2 || vindue(`${M}-P2`); } + check('0. de to smaa popups er aabnet', !!(p1 && p2), 'Chrome viste dem ikke paa 15 s'); + if (p1 && p2) { + console.log(` P1 ${JSON.stringify(p1.frame)} ${p1.subrole} · P2 ${JSON.stringify(p2.frame)} ${p2.subrole}`); + if (p1.frame.w >= 200 && p1.frame.h >= 120 || p2.frame.w >= 200 && p2.frame.h >= 120) { + ryd(); spring(`Chrome gav vinduerne ${p1.frame.w}x${p1.frame.h} og ${p2.frame.w}x${p2.frame.h} - smaavinduesvejen kan ikke naas med Chrome`); + } + // 1. Det taendende kald: P1 har intet web-omraade endnu. + const r1 = hj(['secure-rects', '--app', 'com.google.Chrome']); + check('1. P1 svaertes helt paa det kald der taender Chrome («lige taendt»)', helt(r1.rects, p1.frame), + `rekt i P1 ${JSON.stringify(inde(r1.rects, p1.frame))} grunde ${JSON.stringify(r1.whole_window)}`); + // Vent til P1's kodefelt er bygget. + let fk = { count: 0 }; + for (let i = 0; i < 60 && !fk.count; i++) { await vent(500); fk = hj(['find', '--app', 'com.google.Chrome', '--contains', `${M}-KODE`, '--depth', '60']); } + const r2 = hj(['secure-rects', '--app', 'com.google.Chrome']); + // 2. P2: en tom side - web-omraadet findes, men har intet indhold. + check('2. P2 (tom side) svaertes helt («har et web-omraade», men tomt)', helt(r2.rects, p2.frame), + `rekt i P2 ${JSON.stringify(inde(r2.rects, p2.frame))} grunde ${JSON.stringify(r2.whole_window)}`); + // 3. P1 bygget: kun feltet. + check('3. P1, naar siden er bygget: kun kodefeltet, ikke hele vinduet', + fk.count > 0 && inde(r2.rects, p1.frame).length >= 1 && !helt(r2.rects, p1.frame), + `fundet ${fk.count}, rekt i P1 ${JSON.stringify(inde(r2.rects, p1.frame))}`); + } +} finally { + check('Z. proevens Chrome er lukket igen', chrome.stop(), 'den lever stadig'); + ryd(); +} +console.log(fejl ? `\n${fejl} DUMPET` : '\nBESTAAET'); +process.exit(fejl ? 1 : 0); diff --git a/test/claims-offline.mjs b/test/claims-offline.mjs index 67d68753..b4de5b9c 100644 --- a/test/claims-offline.mjs +++ b/test/claims-offline.mjs @@ -170,7 +170,7 @@ check('porten i sloeringen giver den gennemgangens frist', check('tree_building-tjekket har sin egen frist', /let frist = Date\(\)\.addingTimeInterval\(3\)/.test(sw) && /harWebIndhold\(win, frist: frist\)/.test(sw), 'et tomt find kan haenge'); check('kun vinduer med side-stoerrelse svaertes for et ubygget trae', - /vsub == "AXStandardWindow" && vf!\.w >= 200 && vf!\.h >= 120/.test(sw) && /erChromium, sidevindue, !AX\.harWebIndhold\(win/.test(sw), + /\(vf!\.w >= 200 && vf!\.h >= 120\)/.test(sw) /* R3: uanset underrolle */ && /erChromium, sidevindue, !AX\.harWebIndhold\(win/.test(sw), 'ellers svaertes fanelinje og vaerktoejslinje i hvert billede'); check('Google Chrome staar paa listen', /"com\.google\.Chrome"/.test(sw), 'den eneste browser der er maalt'); diff --git a/test/run-all.sh b/test/run-all.sh index 6372c3ba..e4da70e8 100755 --- a/test/run-all.sh +++ b/test/run-all.sh @@ -37,7 +37,11 @@ run() { ( cd "$ROOT" && eval "$2" ) >> "$LOG" 2>&1 local r=$? [ $r -ne 0 ] && rc=1 - printf "%-22s %s\n" "$1" "$([ $r -eq 0 ] && echo BESTAAET || echo "DUMPET (exit $r)")" + # ⛔ R3 5/11 (Astra): exit 0 med «SPRUNGET OVER» blev skrevet BESTAAET - en proeve der intet maalte. + local udfald="BESTAAET" + [ $r -ne 0 ] && udfald="DUMPET (exit $r)" + [ $r -eq 0 ] && tail -40 "$LOG" | grep -q "^SPRUNGET OVER" && udfald="SPRUNGET OVER (bevist intet)" + printf "%-22s %s\n" "$1" "$udfald" } # ⛔ MAALT 19/9: to af suiterne viser i alt OTTE aegte macOS-dialoger pr. # koersel. De er der med vilje - en dialog der ikke kan ses, beviser intet @@ -141,6 +145,7 @@ run "chrome dyb side" "node test/chrome-dyb-side-live.mjs" run "chrome via server" "node test/chrome-mcp-live.mjs" run "chrome popup" "node test/chrome-popup-live.mjs" run "chrome vault" "node test/chrome-vault-live.mjs" +run "chrome smaa vinduer" "node test/chrome-lille-popup-live.mjs" run "sloeringens grund" "node test/redaction-note.mjs" run "menuvagt" "node test/menu-vagt.mjs" run "genaabn" "node test/genaabn.mjs" From ae5858421456996a6b5656355237ce9cbb63f8d7 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Thu, 5 Nov 2026 09:12:20 +0100 Subject: [PATCH 49/94] Efter R3 (Opus): fast bevis for den tomme side i stedet for et kaploeb, og popup-/timeout-teksterne indsnaevret MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - chrome-side-live trin 2 var et kaploeb under belastning (Opus maalte siden bygget foer andet kald). Nyt trin 2b: et vindue med en tom side skal ALTID svaertes helt - deterministisk, fanger «porten svaerter intet» og «tomt omraade = bygget». - CHANGELOG: en popup paa mindst 200x120 er daekket fra den aabner; en mindre foerst naar dens side findes i traeet. README: «failed or timed out». Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 10 ++++++---- README.md | 2 +- mcp-server/README.md | 2 +- test/chrome-side-live.mjs | 32 +++++++++++++++++++++++++------- 4 files changed, 33 insertions(+), 13 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index dac43f69..1820c906 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -36,10 +36,12 @@ binary carry the switch. After a second review (two reviewers, 5 Nov) the gate fails closed in more places: a Chrome window passes only when the search for its pages reached the end and no lookup answered "don't know" (a timeout, an element Chrome rebuilt mid-scan, a failure); a -window with a web area needs content whatever its role, so an extension popup is -covered; every Chrome window of at least 200x120 goes through the gate whatever its -role, so Chrome's own large bubbles are blacked out while they are open (said in the -note); and on the call that switches Chrome on, small windows go through it too. The +window with a web area needs content whatever its role; every Chrome window of at +least 200x120 goes through the gate whatever its role, so an extension popup of that +size is covered from the moment it opens and Chrome's own large bubbles are blacked +out while they are open (said in the note); and on the call that switches Chrome on, +small windows go through it too. A popup smaller than 200x120 is covered once its page +exists in the tree, not in the moment before. The screenshot note names the reasons per app, `secure-rects` returns them (`whole_window`), and `version` lists `chrome-page-redaction`, so an agent can tell which helper it runs. The Chrome tests say `SPRUNGET OVER` - proved nothing - when the diff --git a/README.md b/README.md index 7fc1af97..32682703 100644 --- a/README.md +++ b/README.md @@ -51,7 +51,7 @@ tree in the background the first time it is switched on, which took 3 to 15 seconds in our measurements; until then a search that finds nothing says `tree_building`, and that Chrome window is blacked out whole in screenshots, with the reason in the answer. A page the scan cannot finish - deeper than it -reaches, or a lookup that timed out - is blacked out whole the same way. Only +reaches, or a lookup that failed or timed out - is blacked out whole the same way. Only Google Chrome is measured. Other Chromium browsers than the ones named above - Chrome app windows (PWAs) included - are not switched on and not covered, and Safari and Firefox are not handled. When a browser tool is in the session, let diff --git a/mcp-server/README.md b/mcp-server/README.md index b8398501..6e23f741 100644 --- a/mcp-server/README.md +++ b/mcp-server/README.md @@ -49,7 +49,7 @@ tree in the background the first time it is switched on, which took 3 to 15 seconds in our measurements; until then a search that finds nothing says `tree_building`, and that Chrome window is blacked out whole in screenshots, with the reason in the answer. A page the scan cannot finish - deeper than it -reaches, or a lookup that timed out - is blacked out whole the same way. Only +reaches, or a lookup that failed or timed out - is blacked out whole the same way. Only Google Chrome is measured. Other Chromium browsers than the ones named above - Chrome app windows (PWAs) included - are not switched on and not covered, and Safari and Firefox are not handled. When a browser tool is in the session, let diff --git a/test/chrome-side-live.mjs b/test/chrome-side-live.mjs index 23ff4181..51ae9be7 100644 --- a/test/chrome-side-live.mjs +++ b/test/chrome-side-live.mjs @@ -25,16 +25,16 @@ import { fileURLToPath } from 'node:url'; const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..'); const H = process.env.CMCP_HELPER || join(ROOT, 'mcp-server', 'vendor', 'cmcp-helper'); const CHROME = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'; -if (!existsSync(CHROME)) { console.log('SPRUNGET OVER: 8 (Google Chrome er ikke installeret her) - bevist intet, ikke bestaaet'); process.exit(0); } +if (!existsSync(CHROME)) { console.log('SPRUNGET OVER: 9 (Google Chrome er ikke installeret her) - bevist intet, ikke bestaaet'); process.exit(0); } // ⛔ MAALT 5/11 kl. 02.09: mens Mac'en er LAAST, bygger Chrome ikke siders tilgaengeligheds-trae. // Et maaleprogram uden hjaelperen fandt 0 web-omraader efter 25,6 s paa en frisk Chrome (laast), // mod 2,1 s kl. 01.20 (ulaast). Proeven maaler da laasen, ikke koden - saa den siger UMAALT. { const io = execFileSync('ioreg', ['-n', 'Root', '-d1'], { encoding: 'utf8' }); - if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) { console.log('SPRUNGET OVER: 8 (skaermen er laast - Chrome bygger ingen sider imens) - bevist intet, ikke bestaaet'); process.exit(0); } + if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) { console.log('SPRUNGET OVER: 9 (skaermen er laast - Chrome bygger ingen sider imens) - bevist intet, ikke bestaaet'); process.exit(0); } } // ⛔ MAALT 5/11 08.21: Chrome henter sig selv frem trods `open -g`. Kun naar personen ikke arbejder. -if (inaktivSek() < MIN_INAKTIV) { console.log(`SPRUNGET OVER: 8 (personen arbejder lige nu - inaktiv ${Math.round(inaktivSek())} s; en ny Chrome henter sig selv frem foran dem) - bevist intet, ikke bestaaet`); process.exit(0); } +if (inaktivSek() < MIN_INAKTIV) { console.log(`SPRUNGET OVER: 9 (personen arbejder lige nu - inaktiv ${Math.round(inaktivSek())} s; en ny Chrome henter sig selv frem foran dem) - bevist intet, ikke bestaaet`); process.exit(0); } let fejl = 0; const check = (navn, ok, hvorfor) => { console.log(`${ok ? 'OK ' : 'DUMP'} ${navn}${ok ? '' : ' - ' + hvorfor}`); if (!ok) fejl++; }; @@ -46,13 +46,17 @@ const side = join(mappe, 'side.html'); writeFileSync(side, `CMCP-LIVE

CMCPLIVEOVERSKRIFT

-

`); +

+`); +// ⛔ R3 5/11 (Opus R3-5, MAALT): trin 2 er et kaploeb - under belastning byggede Chrome siden foer andet kald, og +// trin 2 var roedt mens koden var rigtig. Et vindue med en TOM side er deterministisk: dets web-omraade findes +// og forbliver tomt, saa porten skal altid svaerte det helt (trin 2b). // Vinduets plads og stoerrelse er kendte, saa svarene kan holdes op mod netop det vindue - // hjaelperen ser ogsaa personens eget Chrome. const V = { x: 40, y: 80, w: 760, h: 560 }; // Startes i BAGGRUNDEN (open -g): en direkte start hentede Chrome frem foran personen (5/11). const chrome = await startChrome([`--user-data-dir=${join(mappe, 'profil')}`, '--no-first-run', '--no-default-browser-check', - '--disable-extensions', '--disable-session-crashed-bubble', `--window-position=${V.x},${V.y}`, `--window-size=${V.w},${V.h}`, + '--disable-extensions', '--disable-popup-blocking', '--disable-session-crashed-bubble', `--window-position=${V.x},${V.y}`, `--window-size=${V.w},${V.h}`, `file://${side}`]); const ryd = () => { chrome.stop(); try { rmSync(mappe, { recursive: true, force: true }); } catch {} }; process.on('exit', ryd); @@ -80,14 +84,28 @@ try { // 2. Lige efter: traeet bygges stadig - hele vinduet svaertes. const r2 = hj(['secure-rects', '--app', 'com.google.Chrome']).rects.filter(iVinduet); - check('2. mens siden bygges, svaertes HELE test-vinduet', r2.some(heleVinduet), - `ingen hele-vindue-rektangel i ${JSON.stringify(r2)}`); + const alleredeBygget = hj(['find', '--app', 'com.google.Chrome', '--contains', 'CMCPLIVEFELT', '--depth', '60']).count > 0; + if (alleredeBygget && !r2.some(heleVinduet)) { + console.log(' 2. (oplysning) siden var allerede bygget ved andet kald - kun kodefeltet svaertet, som det skal; trin 2b er det faste bevis'); + } else { + check('2. mens siden bygges, svaertes HELE test-vinduet', r2.some(heleVinduet), `ingen hele-vindue-rektangel i ${JSON.stringify(r2)}`); + } // 3. Siden kommer. let f3 = { count: 0 }; for (let i = 0; i < 60 && !f3.count; i++) { await vent(500); f3 = hj(['find', '--app', 'com.google.Chrome', '--contains', 'CMCPLIVEFELT', '--depth', '60']); } check('3. siden ses: tekstfeltet findes', f3.count > 0 && f3.matches.some((m) => m.role === 'AXTextArea'), 'ikke fundet paa 30 s'); + // 2b. Vinduet med den tomme side: altid helt svaertet (deterministisk; fanger «porten svaerter intet» og + // «et tomt web-omraade taeller som bygget» uden kaploeb). + // Det tomme vindues MAALTE ramme (titlen, Chromes egen brugerflade) - Chrome laegger titellinjen til og kan flytte det. + const tv = (hj(['find', '--app', 'com.google.Chrome', '--role', 'AXWindow', '--contains', 'CMCP-TOM', '--depth', '3'], undefined, { CMCP_INGEN_ELECTRON: '1' }).matches || [])[0]; + const rT = hj(['secure-rects', '--app', 'com.google.Chrome']).rects; + const tf = tv?.frame; + const tomHel = !!tf && rT.some((r) => Math.abs(r.x - tf.x) <= 4 && Math.abs(r.y - tf.y) <= 4 && Math.abs(r.w - tf.w) <= 6 && Math.abs(r.h - tf.h) <= 6); + check('2b. et vindue med en tom side svaertes HELT', tomHel, + tf ? `ingen hele-vindue-rektangel paa ${JSON.stringify(tf)}: ${JSON.stringify(rT.filter((r) => r.x >= tf.x - 4 && r.y >= tf.y - 4 && r.x <= tf.x + tf.w))}` : 'det tomme vindue blev ikke fundet'); + // 4. Nu svaertes kodefeltet - og IKKE hele vinduet. const r4 = hj(['secure-rects', '--app', 'com.google.Chrome']).rects.filter(iVinduet); check('4. kun kodefeltet svaertes, ikke hele vinduet', From d52c2d1f539f5971d0b212f7867d8ad4ec76fa73 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Thu, 5 Nov 2026 09:35:15 +0100 Subject: [PATCH 50/94] Efter R4 (Astra, IKKE GODKENDT): vault-porten lukket paa de veje den manglede MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - computer_type --app skrev gennem den direkte AX-indsaettelse FOER tastetryks-vagten, uden vault-porten (indsaetIFokus). Nu spoerger den. - En ulaeselig adresse gav «ikke vault»; nu «kan ikke afgoeres» = holdt ude af laesningen (skaermbilledet svaerter omraadet). En tom adresse bruger titlen. - Fokus-klatringen skelner nu ikke-vault / vault / ukendt og stopper ved vinduet; «ukendt» i en browser behandles som vault. - at (koordinat-opslaget) giver password_page uden tekst, og serverens klik-port afviser et klik der (som ved et adgangskode-program). - Lister: NordPass' nye id + Edge-udgaverne af Bitwarden, 1Password, LastPass, Dashlane og Keeper (alle bekraeftet 5/11), passwords.avira.com, Keeper AU/CA/JP/ govcloud, Edges og Vivaldis kodeordsstier; passwords.google.com/intro undtaget. - Portens note naevner et browserpanel uden side; run-all vurderer hver proeves EGET output. Flader: atten id'er, klik og graenser (titler, optagelse, kaploebet). Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 17 +++-- README.md | 19 +++--- docs/llms.txt | 2 +- docs/security.html | 2 +- .../Sources/cmcp-helper/Accessibility.swift | 64 +++++++++++++++---- helper/Sources/cmcp-helper/main.swift | 8 +++ mcp-server/README.md | 19 +++--- mcp-server/index.js | 18 ++++-- test/claims-offline.mjs | 14 +++- test/run-all.sh | 8 ++- 10 files changed, 124 insertions(+), 47 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1820c906..1dc97211 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -39,7 +39,8 @@ answered "don't know" (a timeout, an element Chrome rebuilt mid-scan, a failure) window with a web area needs content whatever its role; every Chrome window of at least 200x120 goes through the gate whatever its role, so an extension popup of that size is covered from the moment it opens and Chrome's own large bubbles are blacked -out while they are open (said in the note); and on the call that switches Chrome on, +out while they are open (the note names a browser panel without a page as one possible +reason); and on the call that switches Chrome on, small windows go through it too. A popup smaller than 200x120 is covered once its page exists in the tree, not in the moment before. The screenshot note names the reasons per app, `secure-rects` returns them @@ -51,14 +52,16 @@ screen is locked, instead of passing. pages were readable, so were 1Password's and Bitwarden's popups, web vaults and Chrome's own password page. Now a web area whose address is the browser's password page, a known web vault (1Password, Bitwarden, LastPass, Dashlane, Proton Pass, Keeper, NordPass, -RoboForm, Google Passwords) or one of twelve known password-manager extensions - each id -checked against Chrome Web Store on 5 Nov - is never returned by `computer_find`, -`computer_inspect` or `computer_focused` (the answer says what was left out), its window -is blacked out whole in screenshots, and typing there is refused. The check sits on the +RoboForm, Avira, Google Passwords) or one of eighteen known password-manager extensions +in Chrome and Edge - each id checked against Chrome Web Store or Edge Add-ons on 5 Nov - +is never returned by `computer_find`, `computer_inspect`, `computer_focused` or the +click gate's lookup (the answer says what was left out), its window is blacked out whole +in screenshots, and typing (also the direct accessibility route) or clicking there is +refused. A page whose address cannot be read counts as one that cannot be ruled out. The check sits on the web area, not the window, so a suggestion menu inside another page is covered too, and it applies in any browser that exposes the address. Not covered: self-hosted vaults, -unlisted extensions (the current NordPass extension's id could not be confirmed) and -screen recordings. Test: `test/chrome-vault-live.mjs` against Chrome's own password page. +unlisted extensions, window and menu titles (as for native apps), screen recordings, +and a vault navigated away from in the instant between capture and scan. Test: `test/chrome-vault-live.mjs` against Chrome's own password page. **The screen without a question, if you want it.** Set `CMCP_SCREEN_ASK=0` and an agent that needs the screen borrows it with no question and no Touch ID - at once, or diff --git a/README.md b/README.md index 32682703..f4ec3aa0 100644 --- a/README.md +++ b/README.md @@ -524,14 +524,17 @@ sit unnoticed until it expires. That is a real limitation today, not a setting. they are moved (the known side effect of this switch, not measured on Chrome); any call that looks at Chrome switches it on, not only screenshots. Password managers that run INSIDE a browser are treated like the native ones: a page whose - address is Chrome's own password page, a known web vault (1Password, Bitwarden, - LastPass, Dashlane, Proton Pass, Keeper, NordPass, RoboForm, Google Passwords) or - one of twelve known password-manager extensions - also as a suggestion menu - inside another page - is never returned by `computer_find`, `computer_inspect` or - `computer_focused`, the window is blacked out whole in screenshots, and typing - there is refused. Not covered: a self-hosted vault, an extension not on the list - (the current NordPass extension's id could not be confirmed), and screen - recordings, which leave out apps, not pages. + address is the browser's own password page, a known web vault (1Password, + Bitwarden, LastPass, Dashlane, Proton Pass, Keeper, NordPass, RoboForm, Avira, + Google Passwords) or one of eighteen known password-manager extensions in Chrome + and Edge - also as a suggestion menu inside another page - is never returned by + `computer_find`, `computer_inspect`, `computer_focused` or the click gate, its + window is blacked out whole in screenshots, and typing or clicking there is + refused. A page whose address cannot be read is kept out of the reading tools too. + Not covered: a self-hosted vault, an extension not on the list, window and menu + titles (as for native apps), screen recordings (they leave out apps, not pages), + and a vault that is navigated away from in the instant between the capture and + the scan. `CMCP_INGEN_ELECTRON=1` leaves Chrome's switch off too. And Chrome blocks every extension on Chrome Web Store and its developer console ("The extensions gallery cannot be scripted") - there a browser tool can navigate but not act, and this diff --git a/docs/llms.txt b/docs/llms.txt index a81dcbd9..b8647c77 100644 --- a/docs/llms.txt +++ b/docs/llms.txt @@ -113,7 +113,7 @@ under a friendlier name. - Chrome pages: only Google Chrome is measured; Chrome app windows (PWAs) and unnamed Chromium browsers are not covered. A login inside a cross-site iframe can be missing from the tree while it shows. Password managers inside a browser - (Chrome's own password page, known web vaults, twelve known extensions - also as + (the browser's own password page, known web vaults, eighteen known extensions - also as a suggestion menu in another page) are never returned by find, inspect or focused, and their window is blacked out whole; a self-hosted vault or an unlisted extension is not recognised, and screen recordings leave out apps, not pages. diff --git a/docs/security.html b/docs/security.html index a7a739d8..c1826ef9 100644 --- a/docs/security.html +++ b/docs/security.html @@ -199,7 +199,7 @@

Gate 1 - redaction happens before the file exists

Had we written the file first and redacted after, there would be a window - short, but real - where an unredacted picture of your desktop sat on disk for any other process to read. A security property with a race in it is not a security property.

Two things get painted:

    -
  • Secure text fields. Native fields expose the role AXSecureTextField. Fields in a web page expose the role AXTextField with the subrole AXSecureTextField. Checking only the role catches native fields and lets every browser password box through - which is the case that actually matters. We check both. A field in a web page is only visible once the browser shows its page to the accessibility layer: in Chrome this server switches that on (the switch a screen reader uses), and while a Chrome window's page is not readable yet - still being built, 3 to 15 seconds after it is first switched on, measured on Chrome 156, or empty - the whole window is painted over instead. Not covered: Safari, Firefox, Chromium browsers we do not name, Chrome app windows, and any browser when CMCP_INGEN_ELECTRON=1 is set. Known gaps, not measured: a field in a cross-site frame, or a login step that appears before Chrome has updated its tree. Password managers inside a browser are treated like native ones: a page whose address is the browser's own password page, a known web vault or one of twelve known password-manager extensions (also as a suggestion menu inside another page) is never returned by the reading tools, its window is blacked out whole, and typing there is refused. A self-hosted vault or an unlisted extension is not recognised.
    • +
  • Secure text fields. Native fields expose the role AXSecureTextField. Fields in a web page expose the role AXTextField with the subrole AXSecureTextField. Checking only the role catches native fields and lets every browser password box through - which is the case that actually matters. We check both. A field in a web page is only visible once the browser shows its page to the accessibility layer: in Chrome this server switches that on (the switch a screen reader uses), and while a Chrome window's page is not readable yet - still being built, 3 to 15 seconds after it is first switched on, measured on Chrome 156, or empty - the whole window is painted over instead. Not covered: Safari, Firefox, Chromium browsers we do not name, Chrome app windows, and any browser when CMCP_INGEN_ELECTRON=1 is set. Known gaps, not measured: a field in a cross-site frame, or a login step that appears before Chrome has updated its tree. Password managers inside a browser are treated like native ones: a page whose address is the browser's own password page, a known web vault or one of eighteen known password-manager extensions in Chrome and Edge (also as a suggestion menu inside another page) is never returned by the reading tools, its window is blacked out whole, and typing or clicking there is refused; a page whose address cannot be read is kept out of the reading tools too. Not recognised: a self-hosted vault or an unlisted extension. Not hidden: window and menu titles (as for native apps) and screen recordings.
  • Whole windows of listed apps. Keychain Access, 1Password, Bitwarden, LastPass, Dashlane, Apple Passwords. We do not walk into those windows to decide what to hide; descending into a vault to work out what is secret is the mistake we are avoiding.

The rectangles are painted solid black, not blurred or pixelated. A good enough model can read through pixelation. It cannot read through black.

diff --git a/helper/Sources/cmcp-helper/Accessibility.swift b/helper/Sources/cmcp-helper/Accessibility.swift index 567bd527..47213718 100644 --- a/helper/Sources/cmcp-helper/Accessibility.swift +++ b/helper/Sources/cmcp-helper/Accessibility.swift @@ -738,14 +738,23 @@ enum AX { "pejdijmoenmkgeppbflobdenhhabjlaj", // iCloud Passwords "admmjipmmciaobhojoghlmleefbicajg", // Norton Password Manager "caljgklbbfbcjjanaijlacgncafpegll", // Avira Password Manager + // R4 (Astra) - hver bekraeftet 5/11: Chrome Web Store-titel / Edge Add-ons (getproductdetailsbycrxid) + "eiaeiblijfjekdanodkjadfinkhbfgcd", // NordPass® Password Manager & Digital Vault (den nye) + "jbkfoedolllekgbhcbcoahefnbanhhlh", // Edge: Bitwarden Password Manager + "dppgmdbiimibapkepcbdbmkaabgiofem", // Edge: 1Password – Password Manager + "bbcinlkgjjkejfdpemiealijmmooekmp", // Edge: LastPass + "gehmmocbbkpblljhkekmfhjpfbkclbph", // Edge: Dashlane + "lfochlioelphaglamdcakfjemolpichk", // Edge: Keeper ] /// Browserens egne kodeordssider (adresserne er ens paa alle sprog). static let vaultInterne = ["chrome://password-manager", "chrome://settings/passwords", - "edge://wallet", "edge://settings/passwords", "brave://password-manager", - "brave://settings/passwords", "opera://settings/passwords", "vivaldi://settings/passwords"] + "edge://wallet", "edge://settings/passwords", "edge://settings/autofill/passwords", + "brave://password-manager", "brave://settings/passwords", "opera://settings/passwords", + "vivaldi://settings/passwords", "vivaldi://password-manager"] /// Web-hvaelv: vaerter der ALTID er et hvaelv (hver svarede 5/11; Dashlane 403 = bot-vaern, siden findes). static let vaultVaerter: Set = ["vault.bitwarden.com", "vault.bitwarden.eu", "app.dashlane.com", "pass.proton.me", - "app.nordpass.com", "passwords.google.com", "online.roboform.com"] + "app.nordpass.com", "passwords.google.com", "online.roboform.com", + "passwords.avira.com", "govcloud.keepersecurity.us"] /// 1Password: holdets egen undervaert (agent360.1password.eu) - undtagen markedsfoering og hjaelp. static let enPasswordIkkeHvaelv: Set = ["", "www", "support", "blog", "developer", "releases", "status", "community"] @@ -757,9 +766,12 @@ enum AX { } guard let u = URL(string: url), let vaert = u.host?.lowercased() else { return false } let sti = u.path.lowercased() + // Googles offentlige velkomstside er ikke et hvaelv (R4, Astra). + if vaert == "passwords.google.com", sti.hasPrefix("/intro") { return false } if vaultVaerter.contains(vaert) { return true } let udenWww = vaert.hasPrefix("www.") ? String(vaert.dropFirst(4)) : vaert - if ["lastpass.com", "lastpass.eu", "keepersecurity.com", "keepersecurity.eu"].contains(udenWww), sti.hasPrefix("/vault") { return true } + if ["lastpass.com", "lastpass.eu", "keepersecurity.com", "keepersecurity.eu", "keepersecurity.com.au", + "keepersecurity.ca", "keepersecurity.jp"].contains(udenWww), sti.hasPrefix("/vault") { return true } for d in [".1password.com", ".1password.eu", ".1password.ca"] where vaert.hasSuffix(d) { return !enPasswordIkkeHvaelv.contains(String(vaert.dropLast(d.count))) } @@ -775,28 +787,47 @@ enum AX { /// Navne der kun bruges, naar et web-omraades adresse IKKE kan laeses (saa ved vi ikke - og gaetter lukket). static let vaultNavne = ["1password", "bitwarden", "lastpass", "dashlane", "proton pass", "keeper", "nordpass", - "roboform", "enpass", "password manager", "adgangskodeadministrator"] + "roboform", "enpass", "password manager", "adgangskodeadministrator", "passwords", + "adgangskoder", "avira", "norton", "icloud"] /// Ligger elementet (eller et af dets forfaedre) i en adgangskode-side? Svarer grunden, ellers nil. /// Bruges af alt der skriver eller svarer om FOKUS: computer_type, indsaet, set_value uden maal, focused. static func iVaultSide(_ el: AXUIElement) -> String? { + // ⛔ R4 (Astra): et fejlet forfaedre-opslag eller 80 niveauer gav «ikke vault». Nu skelnes der: naaede vi + // vinduet (eller programmet) uden et hvaelv, er svaret nej; brast kaeden foer, ved vi det ikke - og i en + // BROWSER behandles «ved ikke» som et hvaelv (fail-closed). Uden for browsere findes der ingen web-hvaelv. var op: AXUIElement? = el + var ukendt = true for _ in 0..<80 { - guard let cur = op else { return nil } - if let g = vaultGrund(cur, rolle: string(cur, kAXRoleAttribute as String) ?? "") { return g } - guard let p = attr(cur, kAXParentAttribute as String), CFGetTypeID(p) == AXUIElementGetTypeID() else { return nil } + guard let cur = op else { break } + let r = string(cur, kAXRoleAttribute as String) ?? "" + if let g = vaultGrund(cur, rolle: r) { return g } + if r == "AXWindow" || r == "AXApplication" { ukendt = false; break } + guard let p = attr(cur, kAXParentAttribute as String), CFGetTypeID(p) == AXUIElementGetTypeID() else { break } op = (p as! AXUIElement) } - return nil + guard ukendt else { return nil } + var pid: pid_t = 0 + AXUIElementGetPid(el, &pid) + return erBrowser(NSRunningApplication(processIdentifier: pid)?.bundleIdentifier) + ? "an element in a browser whose page could not be checked" : nil } + static let andreBrowsere: Set = ["com.apple.safari", "com.apple.safaritechnologypreview", "org.mozilla.firefox", + "org.mozilla.firefoxdeveloperedition", "org.mozilla.nightly"] + static func erBrowser(_ bid: String?) -> Bool { erChromium(bid) || andreBrowsere.contains((bid ?? "").lowercased()) } /// Er dette element et web-omraade med en adgangskode-side? Svarer grunden, ellers nil. static func vaultGrund(_ el: AXUIElement, rolle: String) -> String? { guard rolle == "AXWebArea" else { return nil } - if let u = webAdresse(el) { return erVaultAdresse(u) ? "a password manager page" : nil } + // ⛔ R4 (Astra): en ulaeselig adresse sluttede i «ikke vault», og en TOM adresse sprang titlen over. + // Nu: ulaeselig = kan ikke afgoeres = holdes ude (fail-closed); tom = titlen afgoer. + guard let u = webAdresse(el) else { return vaultUkendtGrund } + if !u.isEmpty { return erVaultAdresse(u) ? "a password manager page" : nil } let titel = (string(el, kAXTitleAttribute as String) ?? "").lowercased() - return vaultNavne.contains(where: { titel.contains($0) }) ? "a page that looks like a password manager (its address could not be read)" : nil + return vaultNavne.contains(where: { titel.contains($0) }) ? "a page that looks like a password manager (it has no address)" : nil } + /// Grunden naar adressen ikke kunne laeses: holdes ude af laesningen; i skaermbilledet svaertes OMRAADET, ikke hele vinduet. + static let vaultUkendtGrund = "a page whose address could not be read, so it could not be ruled out as a password manager" /// Find alle rektangler der skal sloeres. Dybden er bevidst begraenset: /// et AX-trae kan vaere uendeligt i en web-visning, og en hjaelper der @@ -973,7 +1004,7 @@ enum AX { let hele = frame(win).map { [$0] } ?? cgRammer(pid: app.processIdentifier) out.append(contentsOf: hele.isEmpty ? [indenfor ?? heleSkaermen()] : hele) if !chromeNoteSat { - sloeringStoppede.append((app.localizedName ?? bid) + " (its page could not be checked - still being built, empty, or not fully readable - so the window was blacked out whole)") + sloeringStoppede.append((app.localizedName ?? bid) + " (its page could not be checked - still being built, empty, not fully readable, or a browser panel that never has a page - so the window was blacked out whole)") chromeNoteSat = true } continue @@ -1004,7 +1035,11 @@ enum AX { var vaultHer: String? = nil walk(win, depth: 0, maxDepth: maxDepth) { el, role in if isSecure(el, role: role), let f = frame(el) { out.append(f) } - if vaultHer == nil, let g = vaultGrund(el, rolle: role) { vaultHer = g } + if vaultHer == nil, let g = vaultGrund(el, rolle: role) { + // R4: en side der ikke kunne afgoeres, svaertes som OMRAADE (fx en reklame-ramme uden adresse); + // et kendt hvaelv tager hele vinduet. + if g == vaultUkendtGrund { if let f = frame(el) { out.append(f) } else { vaultHer = g } } else { vaultHer = g } + } } gennemgangFrist = nil // Vault-porten (5/11): en adgangskode-side et sted i vinduet - ogsaa en indlejret forslagsmenu - @@ -1569,6 +1604,9 @@ extension AX { let rolle = string(el, kAXRoleAttribute as String) ?? "" // Runde 2 (Astra 2): ogsaa AX-vejen skriver kun naar feltet VIDES ikke at vaere sikkert. guard sikkerStatus(el) == false else { return nil } + // ⛔ R4 (Astra, LAEST): computer_type --app skrev her FOER tastetryks-vagten - uden vault-porten. + // nil sender kaldet videre til tastetryksvejen, hvis vagt (fokusErSikkert) saa naegter. + guard iVaultSide(el) == nil else { return nil } var kan: DarwinBoolean = false guard AXUIElementIsAttributeSettable(el, kAXSelectedTextAttribute as CFString, &kan) == .success, kan.boolValue else { return nil } diff --git a/helper/Sources/cmcp-helper/main.swift b/helper/Sources/cmcp-helper/main.swift index fcb597e3..845e74d5 100644 --- a/helper/Sources/cmcp-helper/main.swift +++ b/helper/Sources/cmcp-helper/main.swift @@ -681,6 +681,14 @@ case "at": var pid: pid_t = 0 AXUIElementGetPid(el!, &pid) let app = NSRunningApplication(processIdentifier: pid) + // ⛔ R4 (Astra): punktet kunne laese en adgangskode-sides elementer et for et (titel, beskrivelse, vindue). + // Ligger punktet i en adgangskode-side, siges kun DET - og serveren afviser klikket som ved et adgangskode-program. + if let g = AX.iVaultSide(el!) { + Out.ok(["found": true, "pid": Int(pid), "app": app?.localizedName ?? "", "bundleId": app?.bundleIdentifier ?? "", + "role": AX.string(el!, kAXRoleAttribute as String) ?? "", "title": "", "description": "", "window": "", + "frame": AX.frame(el!)?.dict ?? [:], "window_number": vinduesNr as Any, "under": under, + "password_page": true, "note": "The point is inside \(g); nothing from it is returned."]) + } Out.ok([ "found": true, "pid": Int(pid), diff --git a/mcp-server/README.md b/mcp-server/README.md index 6e23f741..9905c414 100644 --- a/mcp-server/README.md +++ b/mcp-server/README.md @@ -522,14 +522,17 @@ sit unnoticed until it expires. That is a real limitation today, not a setting. they are moved (the known side effect of this switch, not measured on Chrome); any call that looks at Chrome switches it on, not only screenshots. Password managers that run INSIDE a browser are treated like the native ones: a page whose - address is Chrome's own password page, a known web vault (1Password, Bitwarden, - LastPass, Dashlane, Proton Pass, Keeper, NordPass, RoboForm, Google Passwords) or - one of twelve known password-manager extensions - also as a suggestion menu - inside another page - is never returned by `computer_find`, `computer_inspect` or - `computer_focused`, the window is blacked out whole in screenshots, and typing - there is refused. Not covered: a self-hosted vault, an extension not on the list - (the current NordPass extension's id could not be confirmed), and screen - recordings, which leave out apps, not pages. + address is the browser's own password page, a known web vault (1Password, + Bitwarden, LastPass, Dashlane, Proton Pass, Keeper, NordPass, RoboForm, Avira, + Google Passwords) or one of eighteen known password-manager extensions in Chrome + and Edge - also as a suggestion menu inside another page - is never returned by + `computer_find`, `computer_inspect`, `computer_focused` or the click gate, its + window is blacked out whole in screenshots, and typing or clicking there is + refused. A page whose address cannot be read is kept out of the reading tools too. + Not covered: a self-hosted vault, an extension not on the list, window and menu + titles (as for native apps), screen recordings (they leave out apps, not pages), + and a vault that is navigated away from in the instant between the capture and + the scan. `CMCP_INGEN_ELECTRON=1` leaves Chrome's switch off too. And Chrome blocks every extension on Chrome Web Store and its developer console ("The extensions gallery cannot be scripted") - there a browser tool can navigate but not act, and this diff --git a/mcp-server/index.js b/mcp-server/index.js index 5bd8dffb..237eccdf 100644 --- a/mcp-server/index.js +++ b/mcp-server/index.js @@ -272,10 +272,10 @@ that content in the background the first time it is asked, which takes 3 to 15 seconds; a search that finds nothing while a Chrome page is not readable yet says so (\`tree_building\`), and until it is built, that Chrome window is blacked out whole in screenshots. Read again before you conclude a page is empty. Password -managers inside a browser (Chrome's own password page, a known web vault or -password-manager extension) are never returned, like the native apps: an answer -that says skipped_password_pages or denied left one out on purpose - do not try to -read it another way, and ask the person if you need something from it. +managers inside a browser (the browser's own password page, a known web vault or +password-manager extension) are never returned or clicked, like the native apps: an +answer that says skipped_password_pages, password_page or denied left one out on +purpose - do not try to read or click it another way; ask the person instead. When a browser tool is also in this session (Browser MCP's browser_*), let it do the work inside pages, and take over where it is refused: Chrome blocks EVERY extension on Chrome Web Store and its developer console ("The extensions gallery @@ -681,6 +681,8 @@ async function knapErFarlig(name, args, appKlik = null) { // R27: med `app` er det maalprogrammets eget element (doemt i porten), ikke det oeverste vindue. const d = appKlik || await callHelper(['at', '--x', String(args.x), '--y', String(args.y)], { timeout: 8000 }); if (!d?.found) return true; + // R4 5/11 (Astra): et punkt i en adgangskode-side inde i en browser er lige saa farligt som et adgangskode-program. + if (d.password_page) return true; const navne = [d.title, d.description].filter(Boolean); if (!navne.length) return kanVaereKnap(d.role); return navne.some(n => menuSerFarlig(n)); @@ -2005,6 +2007,14 @@ async function haandterKald(request) { ? `Refused: ${appKlik.why}. Nothing was done, and nobody was asked. Clicking the same point again gives the same answer - find the element with computer_find in ${args.app} and use computer_press on it instead.` : `Refused: that point is not inside a window of ${args.app}, so the click would land nowhere it was judged. Nothing was done, and nobody was asked. Locate the element with computer_find in that app and use its centre.`); } + // ⛔ R4 5/11 (Astra): et klik i en adgangskode-side inde i en browser (hjaelperens `at` siger password_page) + // behandles som et adgangskode-program: intet klikkes, og personen skal goere det selv. + if (appKlik.password_page) { + record({ tool: name, tier: tool.tier, args: scrubArgs(args), mode: currentMode(), target: targetBundleId, + decision: 'denied', asked: false, reason: 'click: the point is inside a password manager page' }); + return errorResult(`Refused: that point is inside a password manager page in ${args.app} (${appKlik.note || 'a password page'}). ` + + `Like password manager apps, it is never clicked by an agent. Nothing was done; ask the person to do this step with computer_ask_user.`); + } // ⛔ 10/10 (MAALT): et hoejreklik eller et klik paa en rullemenu i et program BAGVED aabner // menuen paa menneskets skaerm (menulaget 101), og en aaben menu fanger mus og tastatur. // Hjaelperen svarede took_screen:false. Uden skaermlaan sendes saadan et klik ikke. diff --git a/test/claims-offline.mjs b/test/claims-offline.mjs index b4de5b9c..cf4f365c 100644 --- a/test/claims-offline.mjs +++ b/test/claims-offline.mjs @@ -203,12 +203,20 @@ check('kontakten kan slaas fra, saa tallet kan efterproeves udefra', const ids = ['aeblfdkhhhdcdjpifhhbdiojplfjncoa', 'nngceckbapebfimnlniiiahkandclblb', 'hdokiejnpimakedhajhdlcegeplioahd', 'fdjamakpfbbddfjaooikfcpapjohcfmg', 'ghmbeldphafepmbegfdlkpapadhbakde', 'bfogiafebfohielmmehodmfbbebbbpei', 'fooolghllnmhmmndgjiamiiodkpenpbb', 'pnlccmojcmeohlpggmfnbbiapkmbliob', 'kmcfomidfpdkfieipokbalgegidffkal', - 'pejdijmoenmkgeppbflobdenhhabjlaj', 'admmjipmmciaobhojoghlmleefbicajg', 'caljgklbbfbcjjanaijlacgncafpegll']; + 'pejdijmoenmkgeppbflobdenhhabjlaj', 'admmjipmmciaobhojoghlmleefbicajg', 'caljgklbbfbcjjanaijlacgncafpegll', + // R4: NordPass (ny) + Edge-udgaverne, bekraeftet 5/11 + 'eiaeiblijfjekdanodkjadfinkhbfgcd', 'jbkfoedolllekgbhcbcoahefnbanhhlh', 'dppgmdbiimibapkepcbdbmkaabgiofem', + 'bbcinlkgjjkejfdpemiealijmmooekmp', 'gehmmocbbkpblljhkekmfhjpfbkclbph', 'lfochlioelphaglamdcakfjemolpichk']; const liste = sw.slice(sw.indexOf('static let vaultUdvidelser'), sw.indexOf(']', sw.indexOf('static let vaultUdvidelser'))); const mangler = ids.filter((i) => !liste.includes(`"${i}"`)); - check('vault-porten: alle tolv bekraeftede udvidelses-id\'er staar i listen', mangler.length === 0, `mangler ${mangler.join(', ')}`); + check('vault-porten: alle atten bekraeftede udvidelses-id\'er staar i listen', mangler.length === 0, `mangler ${mangler.join(', ')}`); check('vault-porten: find, inspect, focused og fokus-skrivning spoerger alle', /vaultGrund\(el, rolle: r\)/.test(sw) - && /vaultGrund\(el, rolle: role\)/.test(sw) && (sw.match(/iVaultSide\(/g) || []).length >= 4, 'en af vejene mangler'); + && /vaultGrund\(el, rolle: role\)/.test(sw) && (sw.match(/iVaultSide\(/g) || []).length >= 5, 'en af vejene mangler'); + // R4 (Astra): den direkte AX-indsaettelse (computer_type --app) skrev uden om porten. + const ins = sw.slice(sw.indexOf('static func indsaetIFokus'), sw.indexOf('static func', sw.indexOf('static func indsaetIFokus') + 10)); + check('vault-porten: den direkte indsaettelse spoerger ogsaa', /iVaultSide\(el\)/.test(ins), 'indsaetIFokus mangler iVaultSide'); + check('vault-porten: koordinat-opslaget (at) og klik-porten kender adgangskode-sider', + /password_page/.test(mainSw) && /appKlik\.password_page/.test(readFileSync(join(ROOT, 'mcp-server', 'index.js'), 'utf8')), 'at eller serveren mangler password_page'); } const LOEFTER = [ diff --git a/test/run-all.sh b/test/run-all.sh index e4da70e8..7ed00177 100755 --- a/test/run-all.sh +++ b/test/run-all.sh @@ -34,13 +34,17 @@ export CMCP_STATUS_IKON=0 rc=0 run() { echo "===== $1 =====" >> "$LOG" - ( cd "$ROOT" && eval "$2" ) >> "$LOG" 2>&1 + # R4 (Astra): proevens EGET output vurderes - `tail -40` af den samlede log kunne genbruge en tidligere proeves spring. + local ud; ud=$(mktemp "${TMPDIR:-/tmp}/cmcp-run-XXXXXX") + ( cd "$ROOT" && eval "$2" ) > "$ud" 2>&1 local r=$? + cat "$ud" >> "$LOG" [ $r -ne 0 ] && rc=1 # ⛔ R3 5/11 (Astra): exit 0 med «SPRUNGET OVER» blev skrevet BESTAAET - en proeve der intet maalte. local udfald="BESTAAET" [ $r -ne 0 ] && udfald="DUMPET (exit $r)" - [ $r -eq 0 ] && tail -40 "$LOG" | grep -q "^SPRUNGET OVER" && udfald="SPRUNGET OVER (bevist intet)" + [ $r -eq 0 ] && grep -q "^SPRUNGET OVER" "$ud" && udfald="SPRUNGET OVER (bevist intet)" + rm -f "$ud" printf "%-22s %s\n" "$1" "$udfald" } # ⛔ MAALT 19/9: to af suiterne viser i alt OTTE aegte macOS-dialoger pr. From eaaa5819ce61782a920ee510ffa338546f24d004 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Thu, 5 Nov 2026 09:40:22 +0100 Subject: [PATCH 51/94] Flader efter R4 (Opus): vault-porten er et vaern mod uheld, ikke en indhegning - og optagelsen siger det MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Chromes egne kodeords-bobler og autofyld-raekker, ikke-teksttaster, DevTools, udklipsholderen og Safari/Firefox-udvidelser staar nu under «Not covered» paa README, llms.txt, security.html og CHANGELOG. Optagelsens samtykketekst siger at adgangskode- sider i en browser IKKE udelades. Ingen kode i hjaelperen eller proeverne er aendret. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 9 ++++++--- README.md | 11 +++++++---- docs/llms.txt | 6 ++++-- docs/security.html | 2 +- mcp-server/README.md | 11 +++++++---- mcp-server/index.js | 2 +- 6 files changed, 26 insertions(+), 15 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1dc97211..ee49de8d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -59,9 +59,12 @@ click gate's lookup (the answer says what was left out), its window is blacked o in screenshots, and typing (also the direct accessibility route) or clicking there is refused. A page whose address cannot be read counts as one that cannot be ruled out. The check sits on the web area, not the window, so a suggestion menu inside another page is covered too, and -it applies in any browser that exposes the address. Not covered: self-hosted vaults, -unlisted extensions, window and menu titles (as for native apps), screen recordings, -and a vault navigated away from in the instant between capture and scan. Test: `test/chrome-vault-live.mjs` against Chrome's own password page. +it applies in any browser that exposes the address (extension pages: Chrome and Edge only). Not covered: self-hosted vaults, +unlisted extensions, Safari's and Firefox's extension pages, window and menu titles (as +for native apps), Chrome's own password bubbles and autofill rows (native panels, not +pages), screen recordings, and a vault navigated away from in the instant between +capture and scan. It is a guard against accidents, not a fence: non-text keys, +developer tools and the clipboard are not covered. Test: `test/chrome-vault-live.mjs` against Chrome's own password page. **The screen without a question, if you want it.** Set `CMCP_SCREEN_ASK=0` and an agent that needs the screen borrows it with no question and no Touch ID - at once, or diff --git a/README.md b/README.md index f4ec3aa0..3e07a071 100644 --- a/README.md +++ b/README.md @@ -531,10 +531,13 @@ sit unnoticed until it expires. That is a real limitation today, not a setting. `computer_find`, `computer_inspect`, `computer_focused` or the click gate, its window is blacked out whole in screenshots, and typing or clicking there is refused. A page whose address cannot be read is kept out of the reading tools too. - Not covered: a self-hosted vault, an extension not on the list, window and menu - titles (as for native apps), screen recordings (they leave out apps, not pages), - and a vault that is navigated away from in the instant between the capture and - the scan. + It is a guard against accidents, not a fence: keys that are not text (Tab, Enter, + Cmd+C), surfaces that copy a page elsewhere (developer tools, reading mode, the + clipboard) and Chrome's OWN password bubbles and autofill rows - native panels, + not pages - are not covered. Nor are a self-hosted vault, an extension not on the + list, Safari's and Firefox's extension pages, window and menu titles (as for + native apps), screen recordings (they leave out apps, not pages), and a vault + navigated away from in the instant between the capture and the scan. `CMCP_INGEN_ELECTRON=1` leaves Chrome's switch off too. And Chrome blocks every extension on Chrome Web Store and its developer console ("The extensions gallery cannot be scripted") - there a browser tool can navigate but not act, and this diff --git a/docs/llms.txt b/docs/llms.txt index b8647c77..18b89d02 100644 --- a/docs/llms.txt +++ b/docs/llms.txt @@ -115,8 +115,10 @@ under a friendlier name. can be missing from the tree while it shows. Password managers inside a browser (the browser's own password page, known web vaults, eighteen known extensions - also as a suggestion menu in another page) are never returned by find, inspect or focused, - and their window is blacked out whole; a self-hosted vault or an unlisted - extension is not recognised, and screen recordings leave out apps, not pages. + and their window is blacked out whole. A guard against accidents, not a fence: + Chrome's own password bubbles and autofill rows, non-text keys, developer tools, + a self-hosted vault, unlisted or Safari/Firefox extensions are not covered, and + screen recordings leave out apps, not pages. CMCP_INGEN_ELECTRON=1 switches Chrome pages off too, and then their password fields are not blacked out. - Consent is not containment; after approval the agent drives the real Mac. diff --git a/docs/security.html b/docs/security.html index c1826ef9..ef52dfc8 100644 --- a/docs/security.html +++ b/docs/security.html @@ -199,7 +199,7 @@

Gate 1 - redaction happens before the file exists

Had we written the file first and redacted after, there would be a window - short, but real - where an unredacted picture of your desktop sat on disk for any other process to read. A security property with a race in it is not a security property.

Two things get painted:

    -
  • Secure text fields. Native fields expose the role AXSecureTextField. Fields in a web page expose the role AXTextField with the subrole AXSecureTextField. Checking only the role catches native fields and lets every browser password box through - which is the case that actually matters. We check both. A field in a web page is only visible once the browser shows its page to the accessibility layer: in Chrome this server switches that on (the switch a screen reader uses), and while a Chrome window's page is not readable yet - still being built, 3 to 15 seconds after it is first switched on, measured on Chrome 156, or empty - the whole window is painted over instead. Not covered: Safari, Firefox, Chromium browsers we do not name, Chrome app windows, and any browser when CMCP_INGEN_ELECTRON=1 is set. Known gaps, not measured: a field in a cross-site frame, or a login step that appears before Chrome has updated its tree. Password managers inside a browser are treated like native ones: a page whose address is the browser's own password page, a known web vault or one of eighteen known password-manager extensions in Chrome and Edge (also as a suggestion menu inside another page) is never returned by the reading tools, its window is blacked out whole, and typing or clicking there is refused; a page whose address cannot be read is kept out of the reading tools too. Not recognised: a self-hosted vault or an unlisted extension. Not hidden: window and menu titles (as for native apps) and screen recordings.
    • +
  • Secure text fields. Native fields expose the role AXSecureTextField. Fields in a web page expose the role AXTextField with the subrole AXSecureTextField. Checking only the role catches native fields and lets every browser password box through - which is the case that actually matters. We check both. A field in a web page is only visible once the browser shows its page to the accessibility layer: in Chrome this server switches that on (the switch a screen reader uses), and while a Chrome window's page is not readable yet - still being built, 3 to 15 seconds after it is first switched on, measured on Chrome 156, or empty - the whole window is painted over instead. Not covered: Safari, Firefox, Chromium browsers we do not name, Chrome app windows, and any browser when CMCP_INGEN_ELECTRON=1 is set. Known gaps, not measured: a field in a cross-site frame, or a login step that appears before Chrome has updated its tree. Password managers inside a browser are treated like native ones: a page whose address is the browser's own password page, a known web vault or one of eighteen known password-manager extensions in Chrome and Edge (also as a suggestion menu inside another page) is never returned by the reading tools, its window is blacked out whole, and typing or clicking there is refused; a page whose address cannot be read is kept out of the reading tools too. Not recognised: a self-hosted vault, an unlisted extension, Safari's and Firefox's extension pages. Not hidden: window and menu titles (as for native apps), screen recordings, and Chrome's own password bubbles and autofill rows, which are native panels rather than pages. It is a guard against accidents, not a fence: keys that are not text, developer tools and the clipboard are not covered.
  • Whole windows of listed apps. Keychain Access, 1Password, Bitwarden, LastPass, Dashlane, Apple Passwords. We do not walk into those windows to decide what to hide; descending into a vault to work out what is secret is the mistake we are avoiding.

The rectangles are painted solid black, not blurred or pixelated. A good enough model can read through pixelation. It cannot read through black.

diff --git a/mcp-server/README.md b/mcp-server/README.md index 9905c414..8c9a9b70 100644 --- a/mcp-server/README.md +++ b/mcp-server/README.md @@ -529,10 +529,13 @@ sit unnoticed until it expires. That is a real limitation today, not a setting. `computer_find`, `computer_inspect`, `computer_focused` or the click gate, its window is blacked out whole in screenshots, and typing or clicking there is refused. A page whose address cannot be read is kept out of the reading tools too. - Not covered: a self-hosted vault, an extension not on the list, window and menu - titles (as for native apps), screen recordings (they leave out apps, not pages), - and a vault that is navigated away from in the instant between the capture and - the scan. + It is a guard against accidents, not a fence: keys that are not text (Tab, Enter, + Cmd+C), surfaces that copy a page elsewhere (developer tools, reading mode, the + clipboard) and Chrome's OWN password bubbles and autofill rows - native panels, + not pages - are not covered. Nor are a self-hosted vault, an extension not on the + list, Safari's and Firefox's extension pages, window and menu titles (as for + native apps), screen recordings (they leave out apps, not pages), and a vault + navigated away from in the instant between the capture and the scan. `CMCP_INGEN_ELECTRON=1` leaves Chrome's switch off too. And Chrome blocks every extension on Chrome Web Store and its developer console ("The extensions gallery cannot be scripted") - there a browser tool can navigate but not act, and this diff --git a/mcp-server/index.js b/mcp-server/index.js index 237eccdf..de2d8ace 100644 --- a/mcp-server/index.js +++ b/mcp-server/index.js @@ -820,7 +820,7 @@ async function sendeDom(name, args, bid, appKlik = null) { } export function hvorforSpoerg(name, args, { usloeretBillede, optagStart }) { - if (optagStart) return 'Password managers are left out, but one opened mid-recording can show for a moment. Password fields elsewhere are NOT blacked out.'; + if (optagStart) return 'Password manager apps are left out, but one opened mid-recording can show for a moment. Password manager pages inside a browser are NOT left out, and password fields elsewhere are NOT blacked out.'; if (usloeretBillede) return 'Password fields will NOT be blacked out in this image, and the image goes to the agent.'; if (name === 'computer_space') return 'This changes which desktop you are looking at.'; if (name === 'computer_quit' || (name === 'computer_window' && args.button === 'close')) return 'Unsaved work in it can be lost.'; From 4cae5f75f3fbae4a26bc7663a069df42f6855d4b Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Thu, 5 Nov 2026 09:40:41 +0100 Subject: [PATCH 52/94] Optagevaerktoejets beskrivelse: kun adgangskode-PROGRAMMER udelades - en adgangskode-side i en browser optages Co-Authored-By: Claude Opus 5.5 --- mcp-server/tools.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mcp-server/tools.js b/mcp-server/tools.js index 83c16f83..c3b142d2 100644 --- a/mcp-server/tools.js +++ b/mcp-server/tools.js @@ -162,7 +162,7 @@ export const TOOLS = [ { name: 'computer_record', tier: TIER.READ, - description: 'Record the screen to a video file, for a person to watch afterwards - a tutorial, a demo, proof of what was done. action "start" asks the person every time (it is the screen, for minutes; in read-only mode it is refused), then records one display until "stop" or maxSeconds. Only password managers are left out of the recording, including ones opened while it runs; everything else is recorded as it looks - password fields are NOT blacked out the way they are in screenshots. The answer is the file path: this server never reads the file back and never sends it to you. "status" says whether a recording is running. Needs macOS 15.', + description: 'Record the screen to a video file, for a person to watch afterwards - a tutorial, a demo, proof of what was done. action "start" asks the person every time (it is the screen, for minutes; in read-only mode it is refused), then records one display until "stop" or maxSeconds. Only password manager apps are left out of the recording, including ones opened while it runs; everything else is recorded as it looks - also a password manager page inside a browser - password fields are NOT blacked out the way they are in screenshots. The answer is the file path: this server never reads the file back and never sends it to you. "status" says whether a recording is running. Needs macOS 15.', inputSchema: { type: 'object', required: ['action'], From da1dfc407544a4130d36cba7aea87ef9068183a2 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Thu, 5 Nov 2026 09:42:32 +0100 Subject: [PATCH 53/94] Vaerktoejssiden siger det samme om optagelsen som vaerktoejet: en adgangskode-side i en browser optages Co-Authored-By: Claude Opus 5.5 --- docs/tools.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/tools.html b/docs/tools.html index 77bd4fa8..001f8376 100644 --- a/docs/tools.html +++ b/docs/tools.html @@ -287,7 +287,7 @@

computer_recordread

WallWhat actually happens
A full-screen app hides everything elsemeasuredA full-screen window gets its own Space, and both the accessibility API and the screenshot see only the Space in front. Measured: five windows on screen, all belonging to one full-screen editor, while four other apps reported zero. This cost us half a day and it looks exactly like a broken lookup. How to tell.
Electron appsmeasuredChromium builds its tree lazily and an app can ship without enabling it - a bare accessibility call returned 8 nodes and no buttons at depth 14, 30 and 60 alike. This server switches the tree on itself before it looks. Measured on a VS Code fork with two windows open: 0 buttons before, 728 after, same windows, same moment. Not re-measurable on a live process, because the switch cannot be turned off again - use CMCP_INGEN_ELECTRON=1 on a fresh one. Chrome is a separate case: the attribute is an Electron API and Chrome does not implement it. Measured: 29 buttons before and after. You get the browser window, not the page in it.
Electron appsmeasuredChromium builds its tree lazily and an app can ship without enabling it - a bare accessibility call returned 8 nodes and no buttons at depth 14, 30 and 60 alike. This server switches the tree on itself before it looks. Measured on a VS Code fork with two windows open: 0 buttons before, 728 after, same windows, same moment. Not re-measurable on a live process, because the switch cannot be turned off again - use CMCP_INGEN_ELECTRON=1 on a fresh one. Chrome is a separate case: the attribute is an Electron API and Chrome does not implement it (measured: 29 buttons before and after). Chrome's own switch is the one a screen reader sets, and this server sets that one: measured 5 Nov on Chrome 156, a test page went from 0 page elements to 6, its password field among them and blacked out. Chrome builds the page 3 to 15 seconds after it is first switched on; until then an empty search says tree_building and screenshots black that window out whole. Only Google Chrome is measured; Chrome app windows (PWAs) are not covered.
A window on another Spacenot yetcomputer_screenshot with an app name fails when that app's window is on a different Space. The error now says so instead of claiming the app is not running.
App-scoped screenshotsmeasuredMeasured 19/9: asking for one app's window fails for four of five apps with a ScreenCaptureKit streaming error, in the same second that a full-screen capture succeeds. Root cause not found. Full-screen capture works; use it and crop.
Several displaysmeasuredMeasured 19 Sep 2026 on a Mac with three. A screenshot captures one display, and until that day it always captured display 0 without saying so, which meant two thirds of the desktop was invisible with no error. Fixed: computer_screenshot takes a display index, and every answer now reports how many displays exist and which one it took, so an agent that cannot find a window knows where else to look. The earlier row here said "this machine has one" - it had three, and nobody had checked.
maxSecondsstart only. It stops by itself after this long. Default 600, at most 3600.
displayIdstart only. Which display, by the id from computer_displays. Default: the main one.
-

Records one display to a video file, for a person to watch afterwards - a tutorial, a demo, proof of what was done. Starting asks you every time: it is your screen, for minutes. In read-only mode it is refused. Stopping and asking for the status never ask. Only password managers are left out of the recording, including ones opened while it runs (the list is checked about four times a second, so one opened mid-recording can be visible for a moment; if the check cannot be made for two seconds, or a password manager cannot be kept out, the recording stops rather than keep filming). Everything else is recorded as it looks: password fields are not blacked out the way they are in screenshots, and anything typed into an ordinary field is visible. The answer is the file's path - this server never reads the file back and never sends it to the model. It stops on its own at maxSeconds, and when the server that started it ends - if your MCP client quits, that can take up to about half a minute. A server that hangs rather than ends does not count: the recording then runs to maxSeconds, and macOS's own recording indicator is what shows it. Needs macOS 15, and macOS shows its own recording indicator in the menu bar while it runs.

+

Records one display to a video file, for a person to watch afterwards - a tutorial, a demo, proof of what was done. Starting asks you every time: it is your screen, for minutes. In read-only mode it is refused. Stopping and asking for the status never ask. Only password manager apps are left out of the recording, including ones opened while it runs (the list is checked about four times a second, so one opened mid-recording can be visible for a moment; if the check cannot be made for two seconds, or a password manager cannot be kept out, the recording stops rather than keep filming). Everything else is recorded as it looks: a password manager page inside a browser is recorded, password fields are not blacked out the way they are in screenshots, and anything typed into an ordinary field is visible. The answer is the file's path - this server never reads the file back and never sends it to the model. It stops on its own at maxSeconds, and when the server that started it ends - if your MCP client quits, that can take up to about half a minute. A server that hangs rather than ends does not count: the recording then runs to maxSeconds, and macOS's own recording indicator is what shows it. Needs macOS 15, and macOS shows its own recording indicator in the menu bar while it runs.

computer_wait_forread

Wait until an element appears, then return. The alternative is a screenshot loop, and the arithmetic is stark: twenty polls cost one tool call here and twenty images the other way - twenty pictures of a progress bar, in the model's context.

From e3cfcbf571d40f1d000a4439d60b065263cbeb3e Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Thu, 5 Nov 2026 10:11:40 +0100 Subject: [PATCH 54/94] Efter R5 (Astra IKKE GODKENDT, Opus GODKENDT MED RETTELSER): ukendt rolle/program er lukket, genkontrollen ser vault, og proeverne maaler det de hedder MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Hjaelperen: - iVaultSide: en ulaeselig rolle og et ukendt program er «ved ikke» (i en browser = vault). find/inspect gaar ikke ned i et element med ulaeselig rolle i en browser. - at: password_page-svaret har tom rolle, saa aeldre servere fejler lukket (Opus R5-O9). - Adresse-reglen: praefikser skal ende ved en graense; about:logins (Firefox) og Edges extension://-skrivemaade med. Ny kommando vault-url og evnen browser-password-pages. Serveren: klik-genkontrollen afviser hvis punktet nu er en adgangskode-side (Astra R5). Proever: - vault-adresse.mjs: 73 adresser begge veje, uden Chrome (M8/M9 roede). - chrome-vault-live: AEGTE hvaelv-adresse (vault.bitwarden.com via lokal https + host-resolver-rules) i stedet for chrome://password-manager, som Chrome ikke aabner fra kommandolinjen (proeven maalte nye-fane-siden). Groen live 10.1x. - chrome-tom-side-live: tomt vindue alene (M1/M2 deterministisk). Side-proevens popup fjernet: den tog fokus, og Chrome byggede aldrig hovedvinduet (maalt med/uden). - slutDom: roedt mens personen var aktiv = SPRUNGET. optagelse.mjs 8a fulgt med samtykketeksten. Flader: klik-paastanden praeciseret (afvist / spoerger uden app), ikke-fokuserede Chrome-vinduer, regler uden egen proeve listet i CHANGELOG. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 13 ++- README.md | 15 ++- docs/llms.txt | 13 ++- docs/security.html | 2 +- .../Sources/cmcp-helper/Accessibility.swift | 40 +++++--- helper/Sources/cmcp-helper/main.swift | 14 ++- mcp-server/README.md | 15 ++- mcp-server/index.js | 9 +- test/chrome-dyb-side-live.mjs | 6 +- test/chrome-lille-popup-live.mjs | 6 +- test/chrome-mcp-live.mjs | 6 +- test/chrome-popup-live.mjs | 6 +- test/chrome-side-live.mjs | 33 +++---- test/chrome-start.mjs | 14 +++ test/chrome-tom-side-live.mjs | 67 +++++++++++++ test/chrome-vault-live.mjs | 98 ++++++++++--------- test/claims-offline.mjs | 2 + test/optagelse.mjs | 4 +- test/run-all.sh | 2 + test/vault-adresse.mjs | 51 ++++++++++ 20 files changed, 301 insertions(+), 115 deletions(-) create mode 100644 test/chrome-tom-side-live.mjs create mode 100644 test/vault-adresse.mjs diff --git a/CHANGELOG.md b/CHANGELOG.md index ee49de8d..760b8840 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -56,8 +56,17 @@ RoboForm, Avira, Google Passwords) or one of eighteen known password-manager ext in Chrome and Edge - each id checked against Chrome Web Store or Edge Add-ons on 5 Nov - is never returned by `computer_find`, `computer_inspect`, `computer_focused` or the click gate's lookup (the answer says what was left out), its window is blacked out whole -in screenshots, and typing (also the direct accessibility route) or clicking there is -refused. A page whose address cannot be read counts as one that cannot be ruled out. The check sits on the +in screenshots, typing (also the direct accessibility route) is refused, and a click is +refused (without an app named, which needs foreground mode, it asks every time). A page +whose address or role cannot be read in a browser counts as one that cannot be ruled out. +`version` lists `browser-password-pages`; `vault-url --url` answers the address rule on its +own, and `test/vault-adresse.mjs` checks every entry both ways (two mutants turn it red). +Rules with no behavioural test of their own (read in the code, not measured): the page +search must reach its end, the extra "don't know" error codes, the baseline taken before +the gate, a failed window lookup counting as unreadable, the segment rule for other Chrome +channels, the size rule regardless of role, the role and app checks in the focus walk, and +the two small-window rules - Chrome makes `window.open` popups at least 520x446 (measured), +so no test can reach a smaller one. The check sits on the web area, not the window, so a suggestion menu inside another page is covered too, and it applies in any browser that exposes the address (extension pages: Chrome and Edge only). Not covered: self-hosted vaults, unlisted extensions, Safari's and Firefox's extension pages, window and menu titles (as diff --git a/README.md b/README.md index 3e07a071..e65979fb 100644 --- a/README.md +++ b/README.md @@ -51,7 +51,10 @@ tree in the background the first time it is switched on, which took 3 to 15 seconds in our measurements; until then a search that finds nothing says `tree_building`, and that Chrome window is blacked out whole in screenshots, with the reason in the answer. A page the scan cannot finish - deeper than it -reaches, or a lookup that failed or timed out - is blacked out whole the same way. Only +reaches, or a lookup that failed or timed out - is blacked out whole the same way. +A Chrome window that has not been in front since the switch was turned on may +stay unreadable until it is (measured: a page whose window lost focus to a popup +as it loaded was not built in 30 s). Only Google Chrome is measured. Other Chromium browsers than the ones named above - Chrome app windows (PWAs) included - are not switched on and not covered, and Safari and Firefox are not handled. When a browser tool is in the session, let @@ -163,8 +166,8 @@ and that its chain holds. Each gate has a test, and the tests were mutation-checked when they were written: -break the code on purpose and the test goes red. Where a mutant survives, the -CHANGELOG says which and why. See [Testing](#testing). +break the code on purpose and the test goes red. Where a mutant survives or a rule +has no test of its own, the CHANGELOG says which and why. See [Testing](#testing). ## Install @@ -529,8 +532,10 @@ sit unnoticed until it expires. That is a real limitation today, not a setting. Google Passwords) or one of eighteen known password-manager extensions in Chrome and Edge - also as a suggestion menu inside another page - is never returned by `computer_find`, `computer_inspect`, `computer_focused` or the click gate, its - window is blacked out whole in screenshots, and typing or clicking there is - refused. A page whose address cannot be read is kept out of the reading tools too. + window is blacked out whole in screenshots, typing there is refused, and a click + there is refused (or, without an app named, which needs foreground mode, asks + every time) - like password manager apps. A page whose address or role cannot be + read in a browser is kept out of the reading tools too. It is a guard against accidents, not a fence: keys that are not text (Tab, Enter, Cmd+C), surfaces that copy a page elsewhere (developer tools, reading mode, the clipboard) and Chrome's OWN password bubbles and autofill rows - native panels, diff --git a/docs/llms.txt b/docs/llms.txt index 18b89d02..f40d7493 100644 --- a/docs/llms.txt +++ b/docs/llms.txt @@ -115,10 +115,15 @@ under a friendlier name. can be missing from the tree while it shows. Password managers inside a browser (the browser's own password page, known web vaults, eighteen known extensions - also as a suggestion menu in another page) are never returned by find, inspect or focused, - and their window is blacked out whole. A guard against accidents, not a fence: - Chrome's own password bubbles and autofill rows, non-text keys, developer tools, - a self-hosted vault, unlisted or Safari/Firefox extensions are not covered, and - screen recordings leave out apps, not pages. + their window is blacked out whole, typing there is refused, and a click there is + refused or asks every time, like password manager apps. A guard against accidents, + not a fence: Chrome's own password bubbles and autofill rows, non-text keys, + developer tools, the clipboard, window and menu titles, a self-hosted vault, + unlisted or Safari/Firefox extensions are not covered; screen recordings leave out + apps, not pages; a vault navigated away from between capture and scan is not + caught; and a Chrome window smaller than 200x120 is checked only once its page + exists. A Chrome window that has not been in front since the switch was turned on + may stay unreadable until it is. CMCP_INGEN_ELECTRON=1 switches Chrome pages off too, and then their password fields are not blacked out. - Consent is not containment; after approval the agent drives the real Mac. diff --git a/docs/security.html b/docs/security.html index ef52dfc8..8bad15e9 100644 --- a/docs/security.html +++ b/docs/security.html @@ -199,7 +199,7 @@

Gate 1 - redaction happens before the file exists

Had we written the file first and redacted after, there would be a window - short, but real - where an unredacted picture of your desktop sat on disk for any other process to read. A security property with a race in it is not a security property.

Two things get painted:

    -
  • Secure text fields. Native fields expose the role AXSecureTextField. Fields in a web page expose the role AXTextField with the subrole AXSecureTextField. Checking only the role catches native fields and lets every browser password box through - which is the case that actually matters. We check both. A field in a web page is only visible once the browser shows its page to the accessibility layer: in Chrome this server switches that on (the switch a screen reader uses), and while a Chrome window's page is not readable yet - still being built, 3 to 15 seconds after it is first switched on, measured on Chrome 156, or empty - the whole window is painted over instead. Not covered: Safari, Firefox, Chromium browsers we do not name, Chrome app windows, and any browser when CMCP_INGEN_ELECTRON=1 is set. Known gaps, not measured: a field in a cross-site frame, or a login step that appears before Chrome has updated its tree. Password managers inside a browser are treated like native ones: a page whose address is the browser's own password page, a known web vault or one of eighteen known password-manager extensions in Chrome and Edge (also as a suggestion menu inside another page) is never returned by the reading tools, its window is blacked out whole, and typing or clicking there is refused; a page whose address cannot be read is kept out of the reading tools too. Not recognised: a self-hosted vault, an unlisted extension, Safari's and Firefox's extension pages. Not hidden: window and menu titles (as for native apps), screen recordings, and Chrome's own password bubbles and autofill rows, which are native panels rather than pages. It is a guard against accidents, not a fence: keys that are not text, developer tools and the clipboard are not covered.
    • +
  • Secure text fields. Native fields expose the role AXSecureTextField. Fields in a web page expose the role AXTextField with the subrole AXSecureTextField. Checking only the role catches native fields and lets every browser password box through - which is the case that actually matters. We check both. A field in a web page is only visible once the browser shows its page to the accessibility layer: in Chrome this server switches that on (the switch a screen reader uses), and while a Chrome window's page is not readable yet - still being built, 3 to 15 seconds after it is first switched on, measured on Chrome 156, or empty - the whole window is painted over instead. Not covered: Safari, Firefox, Chromium browsers we do not name, Chrome app windows, and any browser when CMCP_INGEN_ELECTRON=1 is set. Known gaps, not measured: a field in a cross-site frame, or a login step that appears before Chrome has updated its tree. Password managers inside a browser are treated like native ones: a page whose address is the browser's own password page, a known web vault or one of eighteen known password-manager extensions in Chrome and Edge (also as a suggestion menu inside another page) is never returned by the reading tools, its window is blacked out whole, typing there is refused, and a click there is refused (or, without an app named, which needs foreground mode, asks every time) - like password manager apps; a page whose address or role cannot be read in a browser is kept out of the reading tools too. Not recognised: a self-hosted vault, an unlisted extension, Safari's and Firefox's extension pages. Not hidden: window and menu titles (as for native apps), screen recordings, and Chrome's own password bubbles and autofill rows, which are native panels rather than pages. It is a guard against accidents, not a fence: keys that are not text, developer tools and the clipboard are not covered.
  • Whole windows of listed apps. Keychain Access, 1Password, Bitwarden, LastPass, Dashlane, Apple Passwords. We do not walk into those windows to decide what to hide; descending into a vault to work out what is secret is the mistake we are avoiding.

The rectangles are painted solid black, not blurred or pixelated. A good enough model can read through pixelation. It cannot read through black.

diff --git a/helper/Sources/cmcp-helper/Accessibility.swift b/helper/Sources/cmcp-helper/Accessibility.swift index 47213718..f89373d2 100644 --- a/helper/Sources/cmcp-helper/Accessibility.swift +++ b/helper/Sources/cmcp-helper/Accessibility.swift @@ -750,7 +750,9 @@ enum AX { static let vaultInterne = ["chrome://password-manager", "chrome://settings/passwords", "edge://wallet", "edge://settings/passwords", "edge://settings/autofill/passwords", "brave://password-manager", "brave://settings/passwords", "opera://settings/passwords", - "vivaldi://settings/passwords", "vivaldi://password-manager"] + "vivaldi://settings/passwords", "vivaldi://password-manager", + // R5 (Opus R5-O7): Firefox' egen kodeordsside + "about:logins"] /// Web-hvaelv: vaerter der ALTID er et hvaelv (hver svarede 5/11; Dashlane 403 = bot-vaern, siden findes). static let vaultVaerter: Set = ["vault.bitwarden.com", "vault.bitwarden.eu", "app.dashlane.com", "pass.proton.me", "app.nordpass.com", "passwords.google.com", "online.roboform.com", @@ -760,9 +762,11 @@ enum AX { static func erVaultAdresse(_ url: String) -> Bool { let lav = url.lowercased() - if vaultInterne.contains(where: { lav.hasPrefix($0) }) { return true } - if lav.hasPrefix("chrome-extension://") { - return vaultUdvidelser.contains(String(lav.dropFirst("chrome-extension://".count).prefix(32))) + // R5 (vault-adresse.mjs): praefikset skal ende ved en graense - «chrome://password-manager-ikke» er ikke siden. + if vaultInterne.contains(where: { p in lav == p || ["/", "?", "#"].contains(where: { lav.hasPrefix(p + $0) }) }) { return true } + // R5 (Opus R5-O7): Edge viser udvidelser som extension://; samme id'er. + for skema in ["chrome-extension://", "extension://"] where lav.hasPrefix(skema) { + return vaultUdvidelser.contains(String(lav.dropFirst(skema.count).prefix(32))) } guard let u = URL(string: url), let vaert = u.host?.lowercased() else { return false } let sti = u.path.lowercased() @@ -800,17 +804,21 @@ enum AX { var ukendt = true for _ in 0..<80 { guard let cur = op else { break } - let r = string(cur, kAXRoleAttribute as String) ?? "" + // ⛔ R5 (Astra, LAEST): en ulaeselig ROLLE blev til "" - et vault-omraade med ulaeselig rolle blev aldrig + // genkendt, og kaeden naaede vinduet og sagde «nej». Nu er en ulaeselig rolle «ved ikke». + guard let r = string(cur, kAXRoleAttribute as String) else { break } if let g = vaultGrund(cur, rolle: r) { return g } if r == "AXWindow" || r == "AXApplication" { ukendt = false; break } guard let p = attr(cur, kAXParentAttribute as String), CFGetTypeID(p) == AXUIElementGetTypeID() else { break } op = (p as! AXUIElement) } guard ukendt else { return nil } + // R5 (Astra): kan programmet ikke slaas op, ved vi heller ikke om det er en browser - lukket. var pid: pid_t = 0 - AXUIElementGetPid(el, &pid) - return erBrowser(NSRunningApplication(processIdentifier: pid)?.bundleIdentifier) - ? "an element in a browser whose page could not be checked" : nil + guard AXUIElementGetPid(el, &pid) == .success, let app = NSRunningApplication(processIdentifier: pid) else { + return "an element whose app and page could not be checked" + } + return erBrowser(app.bundleIdentifier) ? "an element in a browser whose page could not be checked" : nil } static let andreBrowsere: Set = ["com.apple.safari", "com.apple.safaritechnologypreview", "org.mozilla.firefox", "org.mozilla.firefoxdeveloperedition", "org.mozilla.nightly"] @@ -1142,6 +1150,7 @@ enum AX { ]) continue } + let erBrowserApp = erBrowser(app.bundleIdentifier) AX.taendTrae(app.processIdentifier) let axApp = AXUIElementCreateApplication(app.processIdentifier) var wins = (attr(axApp, kAXWindowsAttribute as String) as? [AXUIElement]) ?? [] @@ -1170,12 +1179,17 @@ enum AX { if Date().timeIntervalSince(start) > tidsgraense { stoppedeTidligt = true; break outer } guard besoegt.insert(el).inserted else { continue } guard d < maxDepth else { continue } - let role = string(el, kAXRoleAttribute as String) ?? "" + // R5 (Astra): samme regel som find - en ulaeselig rolle i en browser er «ved ikke». + guard let role = string(el, kAXRoleAttribute as String) ?? (erBrowserApp ? nil : "") else { + nodes.append(["app": app.localizedName ?? "", "bundleId": app.bundleIdentifier ?? "", "depth": d, "denied": true, + "note": "This element's role could not be read in a browser, so it could not be ruled out as a password manager page; it was not opened."]) + continue + } // Vault-porten (5/11): kun AT der er en adgangskode-side - aldrig hvad der staar paa den. if let g = vaultGrund(el, rolle: role) { nodes.append(["app": app.localizedName ?? "", "bundleId": app.bundleIdentifier ?? "", "role": role, "depth": d, "denied": true, - "note": "This is \(g). Like a password manager app, its content is not returned, and screenshots black its window out."]) + "note": "This is \(g). Like a password manager app, its content is not returned, and screenshots black it out."]) continue } let isSecure = isSecure(el, role: role) @@ -1263,6 +1277,7 @@ extension AX { // traeffere. En soegning der kan finde "brugernavn" i 1Password er // den samme laek, bare med et filter paa. if erSpaerret(app, ekstraDeny) { continue } + let erBrowserApp = erBrowser(app.bundleIdentifier) AX.taendTrae(app.processIdentifier) let axApp = AXUIElementCreateApplication(app.processIdentifier) var wins = (attr(axApp, kAXWindowsAttribute as String) as? [AXUIElement]) ?? [] @@ -1298,7 +1313,10 @@ extension AX { // - altsaa det SIDSTE element i laeseretning. En agent der bad // om «den foerste Gem-knap» trykkede den sidste. // Det ramte skrivende kald, ikke kun visningen. - let r = string(el, kAXRoleAttribute as String) ?? "" + // R5 (Astra): i en browser kan en ulaeselig rolle vaere et vault-omraade - saa gaar vi ikke ned i den. + guard let r = string(el, kAXRoleAttribute as String) ?? (erBrowserApp ? nil : "") else { + vaultSprunget.append("\(app.localizedName ?? ""): \(vaultUkendtGrund)"); continue + } // Vault-porten (5/11): intet fra en adgangskode-side - hverken den eller noget under den. if let g = vaultGrund(el, rolle: r) { vaultSprunget.append("\(app.localizedName ?? ""): \(g)"); continue } for c in children(el).reversed() { stack.append((c, d + 1)) } diff --git a/helper/Sources/cmcp-helper/main.swift b/helper/Sources/cmcp-helper/main.swift index 845e74d5..34a51ed0 100644 --- a/helper/Sources/cmcp-helper/main.swift +++ b/helper/Sources/cmcp-helper/main.swift @@ -111,7 +111,9 @@ case "version", "--version", "-v": // R2 (Opus N11): gammel og ny hjaelper svarede ens - nu kan en chat maale hvilken den koerer. // Over 15 tegn MED VILJE: Swift gemmer kortere strenge i koden, ikke i strengtabellen, // og saa kan claims-offline ikke se den i binaeren. - "chrome-page-redaction"]]) + "chrome-page-redaction", + // R4/R5 (Opus N11/R4-12): vault-porten - saa en chat kan maale at den koerer med den. + "browser-password-pages"]]) case "permissions": Out.ok(Perms.report()) @@ -685,7 +687,9 @@ case "at": // Ligger punktet i en adgangskode-side, siges kun DET - og serveren afviser klikket som ved et adgangskode-program. if let g = AX.iVaultSide(el!) { Out.ok(["found": true, "pid": Int(pid), "app": app?.localizedName ?? "", "bundleId": app?.bundleIdentifier ?? "", - "role": AX.string(el!, kAXRoleAttribute as String) ?? "", "title": "", "description": "", "window": "", + // R5 (Opus R5-O9): tom rolle - en AELDRE server kender ikke password_page og ville doemme klikket + // paa rollen; uden rolle og navn fejler den lukket (spoerger) i stedet for at klikke. + "role": "", "title": "", "description": "", "window": "", "frame": AX.frame(el!)?.dict ?? [:], "window_number": vinduesNr as Any, "under": under, "password_page": true, "note": "The point is inside \(g); nothing from it is returned."]) } @@ -705,6 +709,12 @@ case "at": "under": under ]) +case "vault-url": + // R4/R5 (Opus R4-9, Astra): adresse-reglen som ren funktion - saa listerne kan proeves uden Chrome + // (test/vault-adresse.mjs). Et rent opslag: ingen tilgaengelighed, intet netvaerk. + guard let u = args.str("url") else { Out.fail("--url is missing", code: "bad-args") } + Out.ok(["url": u, "password_page": AX.erVaultAdresse(u)]) + case "idle": // Hvor laenge siden der sidst kom tastatur- eller museinput? Skaerm-laanet // (29/9) pauser, naar mennesket selv bruger maskinen. Serveren sammenligner diff --git a/mcp-server/README.md b/mcp-server/README.md index 8c9a9b70..30d7e416 100644 --- a/mcp-server/README.md +++ b/mcp-server/README.md @@ -49,7 +49,10 @@ tree in the background the first time it is switched on, which took 3 to 15 seconds in our measurements; until then a search that finds nothing says `tree_building`, and that Chrome window is blacked out whole in screenshots, with the reason in the answer. A page the scan cannot finish - deeper than it -reaches, or a lookup that failed or timed out - is blacked out whole the same way. Only +reaches, or a lookup that failed or timed out - is blacked out whole the same way. +A Chrome window that has not been in front since the switch was turned on may +stay unreadable until it is (measured: a page whose window lost focus to a popup +as it loaded was not built in 30 s). Only Google Chrome is measured. Other Chromium browsers than the ones named above - Chrome app windows (PWAs) included - are not switched on and not covered, and Safari and Firefox are not handled. When a browser tool is in the session, let @@ -161,8 +164,8 @@ and that its chain holds. Each gate has a test, and the tests were mutation-checked when they were written: -break the code on purpose and the test goes red. Where a mutant survives, the -CHANGELOG says which and why. See [Testing](#testing). +break the code on purpose and the test goes red. Where a mutant survives or a rule +has no test of its own, the CHANGELOG says which and why. See [Testing](#testing). ## Install @@ -527,8 +530,10 @@ sit unnoticed until it expires. That is a real limitation today, not a setting. Google Passwords) or one of eighteen known password-manager extensions in Chrome and Edge - also as a suggestion menu inside another page - is never returned by `computer_find`, `computer_inspect`, `computer_focused` or the click gate, its - window is blacked out whole in screenshots, and typing or clicking there is - refused. A page whose address cannot be read is kept out of the reading tools too. + window is blacked out whole in screenshots, typing there is refused, and a click + there is refused (or, without an app named, which needs foreground mode, asks + every time) - like password manager apps. A page whose address or role cannot be + read in a browser is kept out of the reading tools too. It is a guard against accidents, not a fence: keys that are not text (Tab, Enter, Cmd+C), surfaces that copy a page elsewhere (developer tools, reading mode, the clipboard) and Chrome's OWN password bubbles and autofill rows - native panels, diff --git a/mcp-server/index.js b/mcp-server/index.js index de2d8ace..c862766c 100644 --- a/mcp-server/index.js +++ b/mcp-server/index.js @@ -273,9 +273,9 @@ seconds; a search that finds nothing while a Chrome page is not readable yet say so (\`tree_building\`), and until it is built, that Chrome window is blacked out whole in screenshots. Read again before you conclude a page is empty. Password managers inside a browser (the browser's own password page, a known web vault or -password-manager extension) are never returned or clicked, like the native apps: an -answer that says skipped_password_pages, password_page or denied left one out on -purpose - do not try to read or click it another way; ask the person instead. +password-manager extension) are never returned, and a click there is refused, like the +native apps: an answer that says skipped_password_pages, password_page or denied left +one out on purpose - do not try to read or click it another way; ask the person instead. When a browser tool is also in this session (Browser MCP's browser_*), let it do the work inside pages, and take over where it is refused: Chrome blocks EVERY extension on Chrome Web Store and its developer console ("The extensions gallery @@ -2205,6 +2205,9 @@ async function haandterKald(request) { if (appKlik) { try { igenKlik = await callHelper(['at', '--app', appVaerdi(args, targetBundleId), '--x', String(args.x), '--y', String(args.y)], { timeout: 8000 }); } catch {} if (!igenKlik?.found || igenKlik.window_number !== appKlik.window_number) return 'the window under that point in the app changed while the agent waited'; + // R5 (Astra, MAALT i hukommelsen): genkontrollen saa kun vinduet - skiftede samme vindue til en adgangskode-side + // mens der blev ventet, gik klikket igennem. Nu gaelder samme afvisning som i foerste kontrol. + if (igenKlik.password_page) return 'the point is now inside a password manager page, which is never clicked by an agent'; } const igen = await sendeDom(name, args, targetBundleId, igenKlik); if (JSON.stringify(igen ?? null) !== JSON.stringify(sende ?? null)) { diff --git a/test/chrome-dyb-side-live.mjs b/test/chrome-dyb-side-live.mjs index 05090350..5c54c3b7 100644 --- a/test/chrome-dyb-side-live.mjs +++ b/test/chrome-dyb-side-live.mjs @@ -24,7 +24,8 @@ // aabner et lille Chrome-vindue med en engangs-profil i et par sekunder, og hjaelperen taender // Chromes trae ogsaa i dit eget Chrome (det er produktets adfaerd). Uden Google Chrome: UMAALT. import { execFileSync } from 'node:child_process'; -import { startChrome, inaktivSek, MIN_INAKTIV } from './chrome-start.mjs'; +import { startChrome, inaktivSek, MIN_INAKTIV, slutDom } from './chrome-start.mjs'; +const START_MS = Date.now(); import { existsSync, mkdtempSync, writeFileSync, rmSync } from 'node:fs'; import { tmpdir } from 'node:os'; import { join, dirname } from 'node:path'; @@ -98,5 +99,4 @@ try { check('Z. proevens Chrome er lukket igen', chrome.stop(), 'den lever stadig - naeste proeve ville maale dens vinduer'); ryd(); } -console.log(fejl ? `\n${fejl} DUMPET` : '\nBESTAAET'); -process.exit(fejl ? 1 : 0); +process.exit(slutDom(fejl, 5, START_MS)); diff --git a/test/chrome-lille-popup-live.mjs b/test/chrome-lille-popup-live.mjs index 3c31c8c5..3161a7cc 100644 --- a/test/chrome-lille-popup-live.mjs +++ b/test/chrome-lille-popup-live.mjs @@ -10,7 +10,8 @@ // // Giver Chrome vinduerne mindst 200x120, kan vejen ikke naas i praksis - saa siger proeven SPRUNGET OVER. import { execFileSync } from 'node:child_process'; -import { startChrome, inaktivSek, MIN_INAKTIV } from './chrome-start.mjs'; +import { startChrome, inaktivSek, MIN_INAKTIV, slutDom } from './chrome-start.mjs'; +const START_MS = Date.now(); import { existsSync, mkdtempSync, writeFileSync, rmSync } from 'node:fs'; import { tmpdir } from 'node:os'; import { join, dirname } from 'node:path'; @@ -80,5 +81,4 @@ try { check('Z. proevens Chrome er lukket igen', chrome.stop(), 'den lever stadig'); ryd(); } -console.log(fejl ? `\n${fejl} DUMPET` : '\nBESTAAET'); -process.exit(fejl ? 1 : 0); +process.exit(slutDom(fejl, 5, START_MS)); diff --git a/test/chrome-mcp-live.mjs b/test/chrome-mcp-live.mjs index dcbda6b0..8305735c 100644 --- a/test/chrome-mcp-live.mjs +++ b/test/chrome-mcp-live.mjs @@ -12,7 +12,8 @@ // Koeres bevidst: `node test/chrome-mcp-live.mjs`. Hjaelperen: CMCP_HELPER, ellers vendor/cmcp-helper. // Roerer hverken mus eller tastatur. Aabner et lille Chrome-vindue med en engangs-profil. import { execFileSync } from 'node:child_process'; -import { startChrome, inaktivSek, MIN_INAKTIV } from './chrome-start.mjs'; +import { startChrome, inaktivSek, MIN_INAKTIV, slutDom } from './chrome-start.mjs'; +const START_MS = Date.now(); import { existsSync, mkdtempSync, writeFileSync, rmSync } from 'node:fs'; import { tmpdir } from 'node:os'; import { join, dirname } from 'node:path'; @@ -98,5 +99,4 @@ try { check('Z. proevens Chrome er lukket igen', chrome.stop(), 'den lever stadig - naeste proeve ville maale dens vinduer'); ryd(); } -console.log(fejl ? `\n${fejl} DUMPET` : '\nBESTAAET'); -process.exit(fejl ? 1 : 0); +process.exit(slutDom(fejl, 4, START_MS)); diff --git a/test/chrome-popup-live.mjs b/test/chrome-popup-live.mjs index c38778b0..e4b527c4 100644 --- a/test/chrome-popup-live.mjs +++ b/test/chrome-popup-live.mjs @@ -11,7 +11,8 @@ // // Koeres bevidst: `node test/chrome-popup-live.mjs`. Roerer hverken mus eller tastatur. import { execFileSync } from 'node:child_process'; -import { startChrome, inaktivSek, MIN_INAKTIV } from './chrome-start.mjs'; +import { startChrome, inaktivSek, MIN_INAKTIV, slutDom } from './chrome-start.mjs'; +const START_MS = Date.now(); import { existsSync, mkdtempSync, writeFileSync, rmSync } from 'node:fs'; import { tmpdir } from 'node:os'; import { join, dirname } from 'node:path'; @@ -82,5 +83,4 @@ try { check('Z. proevens Chrome er lukket igen', chrome.stop(), 'den lever stadig - naeste proeve ville maale dens vinduer'); ryd(); } -console.log(fejl ? `\n${fejl} DUMPET` : '\nBESTAAET'); -process.exit(fejl ? 1 : 0); +process.exit(slutDom(fejl, 5, START_MS)); diff --git a/test/chrome-side-live.mjs b/test/chrome-side-live.mjs index 51ae9be7..1e90dfb1 100644 --- a/test/chrome-side-live.mjs +++ b/test/chrome-side-live.mjs @@ -16,7 +16,8 @@ // aabner et lille Chrome-vindue med en engangs-profil i et par sekunder, og hjaelperen taender // Chromes trae ogsaa i dit eget Chrome (det er produktets adfaerd). Uden Google Chrome: UMAALT. import { execFileSync } from 'node:child_process'; -import { startChrome, inaktivSek, MIN_INAKTIV } from './chrome-start.mjs'; +import { startChrome, inaktivSek, MIN_INAKTIV, slutDom } from './chrome-start.mjs'; +const START_MS = Date.now(); import { existsSync, mkdtempSync, writeFileSync, rmSync } from 'node:fs'; import { tmpdir } from 'node:os'; import { join, dirname } from 'node:path'; @@ -25,16 +26,16 @@ import { fileURLToPath } from 'node:url'; const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..'); const H = process.env.CMCP_HELPER || join(ROOT, 'mcp-server', 'vendor', 'cmcp-helper'); const CHROME = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'; -if (!existsSync(CHROME)) { console.log('SPRUNGET OVER: 9 (Google Chrome er ikke installeret her) - bevist intet, ikke bestaaet'); process.exit(0); } +if (!existsSync(CHROME)) { console.log('SPRUNGET OVER: 8 (Google Chrome er ikke installeret her) - bevist intet, ikke bestaaet'); process.exit(0); } // ⛔ MAALT 5/11 kl. 02.09: mens Mac'en er LAAST, bygger Chrome ikke siders tilgaengeligheds-trae. // Et maaleprogram uden hjaelperen fandt 0 web-omraader efter 25,6 s paa en frisk Chrome (laast), // mod 2,1 s kl. 01.20 (ulaast). Proeven maaler da laasen, ikke koden - saa den siger UMAALT. { const io = execFileSync('ioreg', ['-n', 'Root', '-d1'], { encoding: 'utf8' }); - if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) { console.log('SPRUNGET OVER: 9 (skaermen er laast - Chrome bygger ingen sider imens) - bevist intet, ikke bestaaet'); process.exit(0); } + if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) { console.log('SPRUNGET OVER: 8 (skaermen er laast - Chrome bygger ingen sider imens) - bevist intet, ikke bestaaet'); process.exit(0); } } // ⛔ MAALT 5/11 08.21: Chrome henter sig selv frem trods `open -g`. Kun naar personen ikke arbejder. -if (inaktivSek() < MIN_INAKTIV) { console.log(`SPRUNGET OVER: 9 (personen arbejder lige nu - inaktiv ${Math.round(inaktivSek())} s; en ny Chrome henter sig selv frem foran dem) - bevist intet, ikke bestaaet`); process.exit(0); } +if (inaktivSek() < MIN_INAKTIV) { console.log(`SPRUNGET OVER: 8 (personen arbejder lige nu - inaktiv ${Math.round(inaktivSek())} s; en ny Chrome henter sig selv frem foran dem) - bevist intet, ikke bestaaet`); process.exit(0); } let fejl = 0; const check = (navn, ok, hvorfor) => { console.log(`${ok ? 'OK ' : 'DUMP'} ${navn}${ok ? '' : ' - ' + hvorfor}`); if (!ok) fejl++; }; @@ -46,17 +47,16 @@ const side = join(mappe, 'side.html'); writeFileSync(side, `CMCP-LIVE

CMCPLIVEOVERSKRIFT

-

-`); -// ⛔ R3 5/11 (Opus R3-5, MAALT): trin 2 er et kaploeb - under belastning byggede Chrome siden foer andet kald, og -// trin 2 var roedt mens koden var rigtig. Et vindue med en TOM side er deterministisk: dets web-omraade findes -// og forbliver tomt, saa porten skal altid svaerte det helt (trin 2b). +

`); +// ⛔ 5/11 09.11-09.58: trin 2b aabnede et tomt popup fra denne side. MAALT: popuppen tog fokus, og Chrome byggede +// ALDRIG hovedvinduets side (trin 3-4 roede i alle koersler; groenne naar popuppen blev fjernet). Det tomme +// vindue har nu sin egen proeve med ét vindue (chrome-tom-side-live.mjs). // Vinduets plads og stoerrelse er kendte, saa svarene kan holdes op mod netop det vindue - // hjaelperen ser ogsaa personens eget Chrome. const V = { x: 40, y: 80, w: 760, h: 560 }; // Startes i BAGGRUNDEN (open -g): en direkte start hentede Chrome frem foran personen (5/11). const chrome = await startChrome([`--user-data-dir=${join(mappe, 'profil')}`, '--no-first-run', '--no-default-browser-check', - '--disable-extensions', '--disable-popup-blocking', '--disable-session-crashed-bubble', `--window-position=${V.x},${V.y}`, `--window-size=${V.w},${V.h}`, + '--disable-extensions', '--disable-session-crashed-bubble', `--window-position=${V.x},${V.y}`, `--window-size=${V.w},${V.h}`, `file://${side}`]); const ryd = () => { chrome.stop(); try { rmSync(mappe, { recursive: true, force: true }); } catch {} }; process.on('exit', ryd); @@ -96,16 +96,6 @@ try { for (let i = 0; i < 60 && !f3.count; i++) { await vent(500); f3 = hj(['find', '--app', 'com.google.Chrome', '--contains', 'CMCPLIVEFELT', '--depth', '60']); } check('3. siden ses: tekstfeltet findes', f3.count > 0 && f3.matches.some((m) => m.role === 'AXTextArea'), 'ikke fundet paa 30 s'); - // 2b. Vinduet med den tomme side: altid helt svaertet (deterministisk; fanger «porten svaerter intet» og - // «et tomt web-omraade taeller som bygget» uden kaploeb). - // Det tomme vindues MAALTE ramme (titlen, Chromes egen brugerflade) - Chrome laegger titellinjen til og kan flytte det. - const tv = (hj(['find', '--app', 'com.google.Chrome', '--role', 'AXWindow', '--contains', 'CMCP-TOM', '--depth', '3'], undefined, { CMCP_INGEN_ELECTRON: '1' }).matches || [])[0]; - const rT = hj(['secure-rects', '--app', 'com.google.Chrome']).rects; - const tf = tv?.frame; - const tomHel = !!tf && rT.some((r) => Math.abs(r.x - tf.x) <= 4 && Math.abs(r.y - tf.y) <= 4 && Math.abs(r.w - tf.w) <= 6 && Math.abs(r.h - tf.h) <= 6); - check('2b. et vindue med en tom side svaertes HELT', tomHel, - tf ? `ingen hele-vindue-rektangel paa ${JSON.stringify(tf)}: ${JSON.stringify(rT.filter((r) => r.x >= tf.x - 4 && r.y >= tf.y - 4 && r.x <= tf.x + tf.w))}` : 'det tomme vindue blev ikke fundet'); - // 4. Nu svaertes kodefeltet - og IKKE hele vinduet. const r4 = hj(['secure-rects', '--app', 'com.google.Chrome']).rects.filter(iVinduet); check('4. kun kodefeltet svaertes, ikke hele vinduet', @@ -129,5 +119,4 @@ try { check('Z. proevens Chrome er lukket igen', chrome.stop(), 'den lever stadig - naeste proeve ville maale dens vinduer'); ryd(); } -console.log(fejl ? `\n${fejl} DUMPET` : '\nBESTAAET'); -process.exit(fejl ? 1 : 0); +process.exit(slutDom(fejl, 8, START_MS)); diff --git a/test/chrome-start.mjs b/test/chrome-start.mjs index deaf6e55..736aee0f 100644 --- a/test/chrome-start.mjs +++ b/test/chrome-start.mjs @@ -20,6 +20,20 @@ export function inaktivSek() { /// lige foer starten, ikke kun foer hele suiten. export const MIN_INAKTIV = 60; +/// ⛔ 5/11 (Opus R4-5 + maalt 09.45): rørte personen mus eller tastatur UNDER proeven, kan deres vinduer have +/// daekket proevens, og Chrome bygger ikke en side i et vindue der ikke har vaeret forrest. Et roedt resultat +/// beviser da intet om koden. Kaldes til sidst: svarer sandt, hvis personen har vaeret aktiv siden `startMs`. +export function forstyrretSiden(startMs) { return inaktivSek() < (Date.now() - startMs) / 1000 - 1; } +/// Slutlinjen: roedt + forstyrret = SPRUNGET (bevist intet), ellers den aerlige dom. +export function slutDom(fejl, n, startMs) { + if (fejl && forstyrretSiden(startMs)) { + console.log(`SPRUNGET OVER: ${n} (personen kom tilbage undervejs - ${fejl} roede tjek beviser intet om koden) - bevist intet, ikke bestaaet`); + return 0; + } + console.log(fejl ? `\n${fejl} DUMPET` : '\nBESTAAET'); + return fejl ? 1 : 0; +} + export async function startChrome(args) { const profilArg = args.find((a) => a.startsWith('--user-data-dir=')); if (!profilArg) throw new Error('startChrome kraever en egen --user-data-dir'); diff --git a/test/chrome-tom-side-live.mjs b/test/chrome-tom-side-live.mjs new file mode 100644 index 00000000..66fbf78e --- /dev/null +++ b/test/chrome-tom-side-live.mjs @@ -0,0 +1,67 @@ +// Et Chrome-vindue med en TOM side: porten skal altid svaerte det helt. Deterministisk. +// +// ⛔ 5/11 (Opus R3-5 + maalt 09.11-09.58): trin 2 i side-proeven er et kaploeb, og et tomt POPUP fra samme side tog +// fokus, saa Chrome aldrig byggede hovedvinduet. Her er den tomme side det ENESTE vindue. Dets web-omraade findes +// og forbliver tomt, saa porten kan aldrig staa inde for det - uanset tidspunkt. Binder M1 (porten svaerter intet) +// og M2 (et tomt web-omraade taeller som bygget). +// +// 1. web-omraadet findes (siden er bygget - ellers maaler trin 2 noget andet) +// 2. hele vinduet svaertes +import { execFileSync } from 'node:child_process'; +import { startChrome, inaktivSek, MIN_INAKTIV, slutDom } from './chrome-start.mjs'; +import { existsSync, mkdtempSync, writeFileSync, rmSync } from 'node:fs'; +import { tmpdir } from 'node:os'; +import { join, dirname } from 'node:path'; +import { fileURLToPath } from 'node:url'; +const START_MS = Date.now(); + +const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..'); +const H = process.env.CMCP_HELPER || join(ROOT, 'mcp-server', 'vendor', 'cmcp-helper'); +const N = 4; +const spring = (grund) => { console.log(`SPRUNGET OVER: ${N} (${grund}) - bevist intet, ikke bestaaet`); process.exit(0); }; +if (!existsSync('/Applications/Google Chrome.app')) spring('Google Chrome er ikke installeret her'); +{ + const io = execFileSync('ioreg', ['-n', 'Root', '-d1'], { encoding: 'utf8' }); + if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) spring('skaermen er laast - Chrome bygger ingen sider imens'); +} +if (inaktivSek() < MIN_INAKTIV) spring(`personen arbejder lige nu - inaktiv ${Math.round(inaktivSek())} s; en ny Chrome henter sig selv frem foran dem`); + +let fejl = 0; +const check = (navn, ok, hvorfor) => { console.log(`${ok ? 'OK ' : 'DUMP'} ${navn}${ok ? '' : ' - ' + hvorfor}`); if (!ok) fejl++; }; +const hj = (args, env) => JSON.parse(execFileSync(H, args, { encoding: 'utf8', timeout: 60000, env: env ? { ...process.env, ...env } : process.env })); +const vent = (ms) => new Promise((r) => setTimeout(r, ms)); +const M = `CMCPTOM${Date.now().toString(36).toUpperCase()}`; + +const mappe = mkdtempSync(join(tmpdir(), 'cmcp-chrome-tom-')); +writeFileSync(join(mappe, 'tom.html'), `${M}`); +const V = { x: 160, y: 140, w: 640, h: 480 }; +const chrome = await startChrome([`--user-data-dir=${join(mappe, 'profil')}`, '--no-first-run', '--no-default-browser-check', + '--disable-extensions', '--disable-session-crashed-bubble', `--window-position=${V.x},${V.y}`, `--window-size=${V.w},${V.h}`, + `file://${join(mappe, 'tom.html')}`]); +const ryd = () => { chrome.stop(); try { rmSync(mappe, { recursive: true, force: true }); } catch {} }; +process.on('exit', ryd); + +try { + let w = null; + for (let i = 0; i < 60 && !w; i++) { + await vent(250); + w = (hj(['find', '--app', 'com.google.Chrome', '--role', 'AXWindow', '--contains', M, '--depth', '3'], { CMCP_INGEN_ELECTRON: '1' }).matches || [])[0] || null; + } + check('0. vinduet med den tomme side er aabnet', !!w, 'Chrome viste det ikke paa 15 s'); + if (w) { + // 1. Web-omraadet findes (sidens titel baeres af omraadet) - saa er siden bygget, og den ER tom. + let wa = { count: 0 }; + for (let i = 0; i < 60 && !wa.count; i++) { wa = hj(['find', '--app', 'com.google.Chrome', '--role', 'AXWebArea', '--contains', M, '--depth', '20']); if (!wa.count) await vent(500); } + check('1. den tomme sides web-omraade findes (siden er bygget)', wa.count > 0, `intet web-omraade paa 30 s ${JSON.stringify(wa).slice(0, 160)}`); + // 2. Hele vinduet ud. + const f = w.frame; + const sr = hj(['secure-rects', '--app', 'com.google.Chrome']); + const hel = sr.rects.some((r) => Math.abs(r.x - f.x) <= 4 && Math.abs(r.y - f.y) <= 4 && Math.abs(r.w - f.w) <= 6 && Math.abs(r.h - f.h) <= 6); + check('2. vinduet med den tomme side svaertes HELT', hel, + `ingen hele-vindue-rektangel paa ${JSON.stringify(f)}; grunde ${JSON.stringify(sr.whole_window)}`); + } +} finally { + check('Z. proevens Chrome er lukket igen', chrome.stop(), 'den lever stadig'); + ryd(); +} +process.exit(slutDom(fejl, N, START_MS)); diff --git a/test/chrome-vault-live.mjs b/test/chrome-vault-live.mjs index 3ed8df22..2b355591 100644 --- a/test/chrome-vault-live.mjs +++ b/test/chrome-vault-live.mjs @@ -1,66 +1,72 @@ -// Vault-porten: en adgangskode-side INDE i Chrome laeses ikke som tekst og svaertes helt. +// Vault-porten mod en AEGTE hvaelv-adresse: https://vault.bitwarden.com, serveret lokalt. // -// Gustav 5/11: «kør e2e også password programmer i chrome». Chromes egen kodeordsside (chrome://password-manager) -// er en aegte vault-side - i en engangs-profil er den tom, men den har et soegefelt og knapper. +// ⛔ 5/11 09.5x (MAALT): Chrome aabner ikke chrome://password-manager fra kommandolinjen - proeven viste Chromes +// nye-fane-side og maalte en almindelig side. Nu: en lokal https-server (selvsigneret certifikat) og +// --host-resolver-rules, saa Chrome henter `vault.bitwarden.com` hos os. Adressen i tilgaengeligheden (AXURL) er +// da den rigtige hvaelv-adresse - det porten genkender. Serveren lytter paa en tilfaeldig fri port, aldrig 9876-9895. // +// 0. vinduet viser NETOP proevesiden (titlen) - ellers maaler proeven noget andet // 1. naar siden er bygget, svaertes HELE vinduet - af grunden «password manager page» -// 2. find giver INTET tekstfelt fra siden, og svaret siger at en adgangskode-side blev sprunget over -// 3. inspect afleverer kun en «denied»-markering for siden -// -// Koeres bevidst: `node test/chrome-vault-live.mjs`. Roerer hverken mus eller tastatur; kun naar personen er inaktiv. +// 2. find giver INTET fra siden (dens egne markoerer), og svaret siger at en adgangskode-side blev sprunget over +// 3. inspect giver en «denied»-markering og intet af sidens indhold import { execFileSync } from 'node:child_process'; -import { startChrome, inaktivSek, MIN_INAKTIV } from './chrome-start.mjs'; -import { existsSync, mkdtempSync, rmSync } from 'node:fs'; +import { startChrome, inaktivSek, MIN_INAKTIV, slutDom } from './chrome-start.mjs'; +import { existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs'; +import { createServer } from 'node:https'; import { tmpdir } from 'node:os'; import { join, dirname } from 'node:path'; import { fileURLToPath } from 'node:url'; +const START_MS = Date.now(); const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..'); const H = process.env.CMCP_HELPER || join(ROOT, 'mcp-server', 'vendor', 'cmcp-helper'); const N = 5; -if (!existsSync('/Applications/Google Chrome.app')) { console.log(`SPRUNGET OVER: ${N} (Google Chrome er ikke installeret her) - bevist intet, ikke bestaaet`); process.exit(0); } +const spring = (grund) => { console.log(`SPRUNGET OVER: ${N} (${grund}) - bevist intet, ikke bestaaet`); process.exit(0); }; +if (!existsSync('/Applications/Google Chrome.app')) spring('Google Chrome er ikke installeret her'); { const io = execFileSync('ioreg', ['-n', 'Root', '-d1'], { encoding: 'utf8' }); - if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) { console.log(`SPRUNGET OVER: ${N} (skaermen er laast - Chrome bygger ingen sider imens) - bevist intet, ikke bestaaet`); process.exit(0); } + if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) spring('skaermen er laast - Chrome bygger ingen sider imens'); } -if (inaktivSek() < MIN_INAKTIV) { console.log(`SPRUNGET OVER: ${N} (personen arbejder lige nu - inaktiv ${Math.round(inaktivSek())} s; en ny Chrome henter sig selv frem foran dem) - bevist intet, ikke bestaaet`); process.exit(0); } +if (inaktivSek() < MIN_INAKTIV) spring(`personen arbejder lige nu - inaktiv ${Math.round(inaktivSek())} s; en ny Chrome henter sig selv frem foran dem`); let fejl = 0; const check = (navn, ok, hvorfor) => { console.log(`${ok ? 'OK ' : 'DUMP'} ${navn}${ok ? '' : ' - ' + hvorfor}`); if (!ok) fejl++; }; const hj = (args, env) => JSON.parse(execFileSync(H, args, { encoding: 'utf8', timeout: 60000, maxBuffer: 64 * 1024 * 1024, env: env ? { ...process.env, ...env } : process.env })); const vent = (ms) => new Promise((r) => setTimeout(r, ms)); +const M = `CMCPVAULT${Date.now().toString(36).toUpperCase()}`; +// Indholdets markoer staar KUN paa siden, aldrig i titlen: fanen og vinduet baerer sidens titel (metadata, ikke skjult - som for programmer). +const I = `INDHOLD${Math.random().toString(36).slice(2, 10).toUpperCase()}`; + +// Selvsigneret certifikat til vault.bitwarden.com - kun i en engangs-mappe. +const mappe = mkdtempSync(join(tmpdir(), 'cmcp-chrome-vault-')); +execFileSync('/usr/bin/openssl', ['req', '-x509', '-newkey', 'rsa:2048', '-nodes', '-days', '1', '-subj', '/CN=vault.bitwarden.com', + '-keyout', join(mappe, 'k.pem'), '-out', join(mappe, 'c.pem')], { stdio: 'ignore' }); +const side = `${M}-TITEL +

${I}-TEKST

+

`; +const server = createServer({ key: readFileSync(join(mappe, 'k.pem')), cert: readFileSync(join(mappe, 'c.pem')) }, + (_, res) => { res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' }); res.end(side); }); +await new Promise((r) => server.listen(0, '127.0.0.1', r)); +const port = server.address().port; +if (port >= 9876 && port <= 9895) { server.close(); spring(`styresystemet gav port ${port}, som er reserveret browser-mcp`); } const V = { x: 120, y: 110, w: 820, h: 600 }; const iV = (r) => r.x >= V.x - 4 && r.y >= V.y - 4 && r.x + r.w <= V.x + V.w + 4 && r.y + r.h <= V.y + V.h + 4; const heleV = (r) => Math.abs(r.w - V.w) <= 8 && Math.abs(r.h - V.h) <= 8; -// Sidens omraade: under fanelinje og vaerktoejslinje. -const iSiden = (f) => f && f.x >= V.x && f.x + f.w <= V.x + V.w + 4 && f.y >= V.y + 90 && f.y + f.h <= V.y + V.h + 4; - -// ⛔ find/inspect uden soegeord ser OGSAA personens egne Chrome-vinduer. Et geometri-filter alene ville -// taelle deres felter med (falsk roedt) og skrive deres navne i bevisfilen. Derfor et oejebliksbillede -// FOER proevens Chrome starter, og kun FORSKELLEN maales. Intet fra personens vinduer udskrives. -const noegle = (x) => `${x.role}|${x.name || x.title || ''}|${x.value || ''}|${JSON.stringify(x.frame || {})}`; -const findFelter = () => (hj(['find', '--app', 'com.google.Chrome', '--role', 'AXTextField', '--depth', '60', '--limit', '400']).matches || []); -const inspektion = () => hj(['inspect', '--app', 'com.google.Chrome', '--depth', '14', '--limit', '4000']).nodes || []; -const foerFind = new Set(findFelter().map(noegle)); -const foerIns = new Set(inspektion().map(noegle)); - -const mappe = mkdtempSync(join(tmpdir(), 'cmcp-chrome-vault-')); const chrome = await startChrome([`--user-data-dir=${join(mappe, 'profil')}`, '--no-first-run', '--no-default-browser-check', '--disable-extensions', '--disable-session-crashed-bubble', `--window-position=${V.x},${V.y}`, `--window-size=${V.w},${V.h}`, - 'chrome://password-manager/passwords']); -const ryd = () => { chrome.stop(); try { rmSync(mappe, { recursive: true, force: true }); } catch {} }; + `--host-resolver-rules=MAP vault.bitwarden.com 127.0.0.1:${port}`, '--ignore-certificate-errors', 'https://vault.bitwarden.com/']); +const ryd = () => { chrome.stop(); try { server.close(); } catch {} try { rmSync(mappe, { recursive: true, force: true }); } catch {} }; process.on('exit', ryd); try { - // Vent paa vinduet (dets ramme, Chromes egen brugerflade) UDEN at taende traeet. + // 0. Proevesiden, ikke en fejlside: vinduets titel (Chromes egen brugerflade) baerer sidens titel. let set = false; - for (let i = 0; i < 40 && !set; i++) { + for (let i = 0; i < 60 && !set; i++) { await vent(250); - const w = hj(['find', '--app', 'com.google.Chrome', '--role', 'AXWindow', '--depth', '2'], { CMCP_INGEN_ELECTRON: '1' }); - set = (w.matches || []).some((m) => m.frame && heleV(m.frame) && iV(m.frame)); + set = hj(['find', '--app', 'com.google.Chrome', '--role', 'AXWindow', '--contains', `${M}-TITEL`, '--depth', '3'], { CMCP_INGEN_ELECTRON: '1' }).count > 0; } - check('0. test-vinduet med kodeordssiden er aabnet', set, 'intet vindue med den ramme paa 10 s'); + check('0. vinduet viser proevesiden fra «vault.bitwarden.com»', set, 'titlen kom aldrig - adressen blev ikke hentet hos os'); // 1. Naar siden er bygget: hele vinduet ud, af vault-grunden. let sr = { rects: [], whole_window: [] }; @@ -73,23 +79,21 @@ try { sr.rects.filter(iV).some(heleV) && (sr.whole_window || []).some((g) => /password manager page/.test(g)), `rekt ${JSON.stringify(sr.rects.filter(iV))} grunde ${JSON.stringify(sr.whole_window)}`); - // 2. find: intet tekstfelt fra siden (kodeordssiden har et soegefelt), og svaret siger hvorfor. - const f = hj(['find', '--app', 'com.google.Chrome', '--role', 'AXTextField', '--depth', '60', '--limit', '400']); - const fraSiden = (f.matches || []).filter((m) => iSiden(m.frame) && !foerFind.has(noegle(m))); - check('2. find giver intet felt fra kodeordssiden, og siger at den blev sprunget over', - fraSiden.length === 0 && (f.skipped_password_pages || []).length > 0, - `fra siden: ${JSON.stringify(fraSiden.map((m) => m.name || m.role))} sprunget: ${JSON.stringify(f.skipped_password_pages)}`); + // 2. find: sidens EGNE markoerer findes ikke, og svaret siger hvorfor. + const f = hj(['find', '--app', 'com.google.Chrome', '--contains', I, '--depth', '60', '--limit', '50']); + const fraSiden = f.matches || []; + check('2. find giver intet fra siden, og siger at en adgangskode-side blev sprunget over', + fraSiden.length === 0 && (f.skipped_password_pages || []).some((g) => /password manager page/.test(g)), + `fra siden: ${JSON.stringify(fraSiden.map((m) => m.role))} sprunget: ${JSON.stringify(f.skipped_password_pages)}`); - // 3. inspect: kun en «denied»-markering for siden. - const ins = inspektion(); - const naegtet = ins.filter((n) => n.denied && n.role === 'AXWebArea' && /password manager page/.test(n.note || '')); - const indhold = ins.filter((n) => !n.denied && iSiden(n.frame) && (n.value || n.title) && !foerIns.has(noegle(n))); - check('3. inspect giver en «denied»-markering og intet indhold fra siden', - naegtet.length > 0 && indhold.length === 0, - `naegtet ${naegtet.length}, indhold fra siden: ${JSON.stringify(indhold.slice(0, 5).map((n) => n.title || n.value))}`); + // 3. inspect: kun en «denied»-markering; intet med sidens markoer (vinduets titel er Chromes egen - den taeller ikke). + const ins = hj(['inspect', '--app', 'com.google.Chrome', '--depth', '14', '--limit', '4000']).nodes || []; + const naegtet = ins.filter((n) => n.denied && /password manager page/.test(n.note || '')); + const indhold = ins.filter((n) => !n.denied && JSON.stringify([n.title, n.value, n.desc]).includes(I)); + check('3. inspect giver en «denied»-markering og intet af sidens indhold', + naegtet.length > 0 && indhold.length === 0, `naegtet ${naegtet.length}, med sidens markoer: ${indhold.map((n) => n.role).join(', ')}`); } finally { check('Z. proevens Chrome er lukket igen', chrome.stop(), 'den lever stadig'); ryd(); } -console.log(fejl ? `\n${fejl} DUMPET` : '\nBESTAAET'); -process.exit(fejl ? 1 : 0); +process.exit(slutDom(fejl, N, START_MS)); diff --git a/test/claims-offline.mjs b/test/claims-offline.mjs index cf4f365c..8239b798 100644 --- a/test/claims-offline.mjs +++ b/test/claims-offline.mjs @@ -231,6 +231,8 @@ const LOEFTER = [ ['chrome-page-redaction', 'siger selv at den kan Chrome-sider (version)'], // Vault-porten 5/11: et id fra listen (32 tegn, ligger i strengtabellen) - en binaer uden porten kan ikke bestaa. ['nngceckbapebfimnlniiiahkandclblb', 'adgangskode-sider i browsere holdes ude (vault-porten)'], + // R5: evnen en chat spoerger efter - over 15 tegn, saa den ligger i strengtabellen. + ['browser-password-pages', 'siger selv at den har vault-porten (version)'], ]; const BIN = join(ROOT, 'mcp-server', 'vendor', 'cmcp-helper'); let raa = null; diff --git a/test/optagelse.mjs b/test/optagelse.mjs index 87690f4c..ae226f14 100644 --- a/test/optagelse.mjs +++ b/test/optagelse.mjs @@ -171,7 +171,9 @@ function server(mode, svar, navn, ekstra = {}) { s.srv.kill(); const [t5, t30, tStor, t149] = s.sp.tekster(); check('8a dialogen for en optagelse lover ikke en sletning, og siger hvad der IKKE udelades', - !!t5 && !/deletes or clears/.test(t5) && /Password managers are left out/.test(t5) && /password fields/i.test(t5), + !!t5 && !/deletes or clears/.test(t5) && /Password manager apps are left out/.test(t5) + // R5 (Opus): samtykket siger nu ogsaa at adgangskode-SIDER i en browser optages. + && /Password manager pages inside a browser are NOT left out/.test(t5) && /password fields/i.test(t5), (t5 || '').replace(/\n+/g, ' ').slice(0, 160)); check('8b tiden i dialogen er den tid der optages', /30 seconds/.test(t30 || '') && /60 minutes/.test(tStor || '') && !/1 minutes/.test(t30 || ''), diff --git a/test/run-all.sh b/test/run-all.sh index 7ed00177..cfcd3497 100755 --- a/test/run-all.sh +++ b/test/run-all.sh @@ -149,6 +149,8 @@ run "chrome dyb side" "node test/chrome-dyb-side-live.mjs" run "chrome via server" "node test/chrome-mcp-live.mjs" run "chrome popup" "node test/chrome-popup-live.mjs" run "chrome vault" "node test/chrome-vault-live.mjs" +run "chrome tom side" "node test/chrome-tom-side-live.mjs" +run "vault-adresser" "node test/vault-adresse.mjs" run "chrome smaa vinduer" "node test/chrome-lille-popup-live.mjs" run "sloeringens grund" "node test/redaction-note.mjs" run "menuvagt" "node test/menu-vagt.mjs" diff --git a/test/vault-adresse.mjs b/test/vault-adresse.mjs new file mode 100644 index 00000000..16ef2c5b --- /dev/null +++ b/test/vault-adresse.mjs @@ -0,0 +1,51 @@ +// Vault-portens adresse-regel som ren funktion - uden Chrome, uden tilgaengelighed. +// +// ⛔ R4/R5 (Opus R4-9, Astra): claims-offline tjekkede kun at strengene STOD i kilden; en mutant der fjernede +// passwords.google.com fra listen overlevede alt. Her spoerges hjaelperen selv (`vault-url`) om hver adresse, +// begge veje: hver post paa listen SKAL genkendes, og grænsetilfaeldene maa IKKE. +import { execFileSync } from 'node:child_process'; +import { existsSync } from 'node:fs'; +import { join, dirname } from 'node:path'; +import { fileURLToPath } from 'node:url'; + +const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..'); +const H = process.env.CMCP_HELPER || join(ROOT, 'mcp-server', 'vendor', 'cmcp-helper'); +if (!existsSync(H)) { console.log('SPRUNGET OVER: 1 (ingen bygget hjaelper her) - bevist intet, ikke bestaaet'); process.exit(0); } +let fejl = 0, ok = 0; +const sp = (u) => JSON.parse(execFileSync(H, ['vault-url', '--url', u], { encoding: 'utf8' })).password_page; + +const ER = [ + // browserens egne kodeordssider + 'chrome://password-manager/passwords', 'chrome://settings/passwords', 'edge://wallet/passwords', + 'edge://settings/passwords', 'edge://settings/autofill/passwords/checkup', 'brave://password-manager/passwords', + 'brave://settings/passwords', 'opera://settings/passwords', 'vivaldi://settings/passwords', 'vivaldi://password-manager/settings', + 'about:logins', 'about:logins?filter=x', 'extension://nngceckbapebfimnlniiiahkandclblb/popup/index.html', + // web-hvaelv + 'https://my.1password.com/vaults', 'https://agent360.1password.eu/', 'https://start.1password.com/signin', 'https://team.1password.ca/', + 'https://vault.bitwarden.com/#/vault', 'https://vault.bitwarden.eu/', 'https://app.dashlane.com/', 'https://pass.proton.me/', + 'https://app.nordpass.com/', 'https://passwords.google.com/options', 'https://online.roboform.com/', 'https://passwords.avira.com/', + 'https://govcloud.keepersecurity.us/vault/', 'https://lastpass.com/vault/', 'https://www.lastpass.com/vault/', 'https://lastpass.eu/vault/', + 'https://keepersecurity.com/vault/', 'https://keepersecurity.eu/vault/', 'https://keepersecurity.com.au/vault/', + 'https://keepersecurity.ca/vault/', 'https://keepersecurity.jp/vault/', + // udvidelser (Chrome Web Store + Edge Add-ons, hver bekraeftet 5/11) + ...['aeblfdkhhhdcdjpifhhbdiojplfjncoa', 'nngceckbapebfimnlniiiahkandclblb', 'hdokiejnpimakedhajhdlcegeplioahd', + 'fdjamakpfbbddfjaooikfcpapjohcfmg', 'ghmbeldphafepmbegfdlkpapadhbakde', 'bfogiafebfohielmmehodmfbbebbbpei', + 'fooolghllnmhmmndgjiamiiodkpenpbb', 'pnlccmojcmeohlpggmfnbbiapkmbliob', 'kmcfomidfpdkfieipokbalgegidffkal', + 'pejdijmoenmkgeppbflobdenhhabjlaj', 'admmjipmmciaobhojoghlmleefbicajg', 'caljgklbbfbcjjanaijlacgncafpegll', + 'eiaeiblijfjekdanodkjadfinkhbfgcd', 'jbkfoedolllekgbhcbcoahefnbanhhlh', 'dppgmdbiimibapkepcbdbmkaabgiofem', + 'bbcinlkgjjkejfdpemiealijmmooekmp', 'gehmmocbbkpblljhkekmfhjpfbkclbph', 'lfochlioelphaglamdcakfjemolpichk'] + .map((id) => `chrome-extension://${id}/popup/index.html`), +]; +const ER_IKKE = [ + 'https://1password.com/', 'https://www.1password.com/', 'https://support.1password.com/', 'https://blog.1password.com/x', + 'https://passwords.google.com/intro', 'https://lastpass.com/', 'https://lastpass.com/pricing', 'https://keepersecurity.com/', + 'https://bitwarden.com/', 'https://example.com/vault/', 'https://vault.bitwarden.com.example.com/', 'file:///Users/x/side.html', + 'chrome://settings/', 'chrome://newtab/', 'chrome-extension://abcdefghijklmnopabcdefghijklmnop/popup.html', 'about:blank', + 'https://www.google.com/search?q=1password', 'chrome://password-manager-ikke', + 'about:loginsx', 'extension://abcdefghijklmnopabcdefghijklmnop/x.html', 'moz-extension://nngceckbapebfimnlniiiahkandclblb/', +]; +for (const u of ER) { if (sp(u) === true) ok++; else { fejl++; console.log(`DUMP genkendes ikke: ${u}`); } } +for (const u of ER_IKKE) { if (sp(u) === false) ok++; else { fejl++; console.log(`DUMP genkendes forkert: ${u}`); } } +console.log(`${ok} OK af ${ER.length + ER_IKKE.length}`); +console.log(fejl ? `\n${fejl} DUMPET` : '\nBESTAAET'); +process.exit(fejl ? 1 : 0); From fbd2dfc1a579610005ca601ab1a6f9b94570c1bf Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Thu, 5 Nov 2026 10:53:52 +0100 Subject: [PATCH 55/94] Efter R6 (Astra IKKE GODKENDT; Opus' R6 doede to gange paa DNS): klik-genkontrollen for alle app-klik, ufuldstaendige svar siges MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Serveren: genkontrollen af adgangskode-sider laa inde i beskedSlags - serverens browser- liste er kortere end hjaelperens (Chrome Beta, for Testing, Firefox Nightly gik uden). Nu for ALLE app-klik. Instruktionen siger praecist: afvist med app, kraever personen uden. - Hjaelperen: en gren sprunget pga. ulaeselig rolle saetter stoppedeTidligt, saa en skrivning aldrig vaelger «det eneste» fund (valgEfterSoegning -> ufuldstaendig); egen grund (rolle, ikke adresse) og egen note (tidSlut skiller tidsudloeb fra rollefejl). Et program uden bundle-id er «ved ikke». Udvidelses-id og stier kraever en graense. - vault-adresse: 79 adresser. chrome-vault-live naegter at maale, hvis et andet Chrome- vindue allerede viser en adgangskode-side (grunden er pr. program, ikke vindue). - CHANGELOG: vault-proeven beskrevet rigtigt; flere regler i listen uden egen proeve. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 6 ++-- .../Sources/cmcp-helper/Accessibility.swift | 32 +++++++++++++------ helper/Sources/cmcp-helper/main.swift | 8 +++-- mcp-server/index.js | 19 +++++++---- test/chrome-vault-live.mjs | 10 ++++++ test/vault-adresse.mjs | 4 +++ 6 files changed, 60 insertions(+), 19 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 760b8840..a0e6e385 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -66,14 +66,16 @@ search must reach its end, the extra "don't know" error codes, the baseline take the gate, a failed window lookup counting as unreadable, the segment rule for other Chrome channels, the size rule regardless of role, the role and app checks in the focus walk, and the two small-window rules - Chrome makes `window.open` popups at least 520x446 (measured), -so no test can reach a smaller one. The check sits on the +so no test can reach a smaller one - the role checks that skip a browser branch in find and +inspect (and mark the answer incomplete, so a write never picks the one match left), the +empty role in a password-page answer for older servers, and the click gate's recheck. The check sits on the web area, not the window, so a suggestion menu inside another page is covered too, and it applies in any browser that exposes the address (extension pages: Chrome and Edge only). Not covered: self-hosted vaults, unlisted extensions, Safari's and Firefox's extension pages, window and menu titles (as for native apps), Chrome's own password bubbles and autofill rows (native panels, not pages), screen recordings, and a vault navigated away from in the instant between capture and scan. It is a guard against accidents, not a fence: non-text keys, -developer tools and the clipboard are not covered. Test: `test/chrome-vault-live.mjs` against Chrome's own password page. +developer tools and the clipboard are not covered. Test: `test/chrome-vault-live.mjs` against a real vault address (`https://vault.bitwarden.com`, served locally over HTTPS and pointed at with `--host-resolver-rules`; Chrome does not open its own password page from the command line). **The screen without a question, if you want it.** Set `CMCP_SCREEN_ASK=0` and an agent that needs the screen borrows it with no question and no Touch ID - at once, or diff --git a/helper/Sources/cmcp-helper/Accessibility.swift b/helper/Sources/cmcp-helper/Accessibility.swift index f89373d2..8b4271ff 100644 --- a/helper/Sources/cmcp-helper/Accessibility.swift +++ b/helper/Sources/cmcp-helper/Accessibility.swift @@ -766,16 +766,20 @@ enum AX { if vaultInterne.contains(where: { p in lav == p || ["/", "?", "#"].contains(where: { lav.hasPrefix(p + $0) }) }) { return true } // R5 (Opus R5-O7): Edge viser udvidelser som extension://; samme id'er. for skema in ["chrome-extension://", "extension://"] where lav.hasPrefix(skema) { - return vaultUdvidelser.contains(String(lav.dropFirst(skema.count).prefix(32))) + // R6 (Astra): id'et skal efterfoelges af en graense - «.example» er ikke udvidelsen. + let rest = lav.dropFirst(skema.count) + let efter = rest.dropFirst(32).first + return vaultUdvidelser.contains(String(rest.prefix(32))) && (efter == nil || "/?#".contains(efter!)) } guard let u = URL(string: url), let vaert = u.host?.lowercased() else { return false } let sti = u.path.lowercased() // Googles offentlige velkomstside er ikke et hvaelv (R4, Astra). - if vaert == "passwords.google.com", sti.hasPrefix("/intro") { return false } + let paaSti = { (p: String) in sti == p || sti.hasPrefix(p + "/") } // R6 (Astra): «/intro-private», «/vaulting» er ikke stien + if vaert == "passwords.google.com", paaSti("/intro") { return false } if vaultVaerter.contains(vaert) { return true } let udenWww = vaert.hasPrefix("www.") ? String(vaert.dropFirst(4)) : vaert if ["lastpass.com", "lastpass.eu", "keepersecurity.com", "keepersecurity.eu", "keepersecurity.com.au", - "keepersecurity.ca", "keepersecurity.jp"].contains(udenWww), sti.hasPrefix("/vault") { return true } + "keepersecurity.ca", "keepersecurity.jp"].contains(udenWww), paaSti("/vault") { return true } for d in [".1password.com", ".1password.eu", ".1password.ca"] where vaert.hasSuffix(d) { return !enPasswordIkkeHvaelv.contains(String(vaert.dropLast(d.count))) } @@ -818,7 +822,9 @@ enum AX { guard AXUIElementGetPid(el, &pid) == .success, let app = NSRunningApplication(processIdentifier: pid) else { return "an element whose app and page could not be checked" } - return erBrowser(app.bundleIdentifier) ? "an element in a browser whose page could not be checked" : nil + // R6 (Astra): et program uden bundle-id kan heller ikke udelukkes som browser. + guard let bid = app.bundleIdentifier else { return "an element whose app could not be identified, so its page could not be checked" } + return erBrowser(bid) ? "an element in a browser whose page could not be checked" : nil } static let andreBrowsere: Set = ["com.apple.safari", "com.apple.safaritechnologypreview", "org.mozilla.firefox", "org.mozilla.firefoxdeveloperedition", "org.mozilla.nightly"] @@ -836,6 +842,8 @@ enum AX { } /// Grunden naar adressen ikke kunne laeses: holdes ude af laesningen; i skaermbilledet svaertes OMRAADET, ikke hele vinduet. static let vaultUkendtGrund = "a page whose address could not be read, so it could not be ruled out as a password manager" + /// R6 (Astra): en ulaeselig ROLLE i en browser har sin egen grund - ikke «adressen». + static let vaultRolleGrund = "a browser element whose role could not be read, so it could not be ruled out as a password manager page" /// Find alle rektangler der skal sloeres. Dybden er bevidst begraenset: /// et AX-trae kan vaere uendeligt i en web-visning, og en hjaelper der @@ -1106,6 +1114,8 @@ enum AX { /// svarede ikke». Nu stopper gennemgangen ved en tidsgraense og SIGER det, /// i stedet for at loebe ind i muren. Samme aerlighed som tekst-loftet. static var stoppedeTidligt = false + /// R6: stoppede soegningen paa TIDEN (ikke kun fordi en gren ikke kunne laeses)? Styrer noten. + static var tidSlut = false static let tidsgraense: Double = Double(ProcessInfo.processInfo.environment["CMCP_BUDGET_SEK"] ?? "") ?? 10 /// Sloeringens EGET loft - adskilt fra `tidsgraense` med vilje. @@ -1133,7 +1143,7 @@ enum AX { static func inspect(bundleId: String?, maxDepth: Int, maxNodes: Int, ekstraDeny: Set = []) -> [[String: Any]] { let start = Date() - stoppedeTidligt = false + stoppedeTidligt = false; tidSlut = false langsommeOpslag = 0 var nodes: [[String: Any]] = [] let apps = allApps().filter { a in @@ -1176,11 +1186,12 @@ enum AX { var stack: [(AXUIElement, Int)] = [(win, 0)] while let (el, d) = stack.popLast() { if nodes.count >= maxNodes { break outer } - if Date().timeIntervalSince(start) > tidsgraense { stoppedeTidligt = true; break outer } + if Date().timeIntervalSince(start) > tidsgraense { stoppedeTidligt = true; tidSlut = true; break outer } guard besoegt.insert(el).inserted else { continue } guard d < maxDepth else { continue } // R5 (Astra): samme regel som find - en ulaeselig rolle i en browser er «ved ikke». guard let role = string(el, kAXRoleAttribute as String) ?? (erBrowserApp ? nil : "") else { + stoppedeTidligt = true // R6 (Astra): svaret er ikke fuldstaendigt nodes.append(["app": app.localizedName ?? "", "bundleId": app.bundleIdentifier ?? "", "depth": d, "denied": true, "note": "This element's role could not be read in a browser, so it could not be ruled out as a password manager page; it was not opened."]) continue @@ -1258,7 +1269,7 @@ extension AX { ) -> [Match] { var out: [Match] = [] let start = Date() - stoppedeTidligt = false + stoppedeTidligt = false; tidSlut = false vaultSprunget = [] let wantRole = role?.lowercased() let wantTitle = title?.lowercased() @@ -1303,7 +1314,7 @@ extension AX { var stack: [(AXUIElement, Int)] = [(win, 0)] while let (el, d) = stack.popLast() { if out.count >= limit { break outer } - if Date().timeIntervalSince(start) > tidsgraense { stoppedeTidligt = true; break outer } + if Date().timeIntervalSince(start) > tidsgraense { stoppedeTidligt = true; tidSlut = true; break outer } guard besoegt.insert(el).inserted else { continue } guard d < maxDepth else { continue } // ⛔ `.reversed()` ER rettelsen, fundet af et modstander-review 22/9. @@ -1315,7 +1326,10 @@ extension AX { // Det ramte skrivende kald, ikke kun visningen. // R5 (Astra): i en browser kan en ulaeselig rolle vaere et vault-omraade - saa gaar vi ikke ned i den. guard let r = string(el, kAXRoleAttribute as String) ?? (erBrowserApp ? nil : "") else { - vaultSprunget.append("\(app.localizedName ?? ""): \(vaultUkendtGrund)"); continue + // R6 (Astra): en sprunget gren kan rumme et felt med samme navn - saa er svaret ikke fuldstaendigt, + // og en skrivning maa ikke vaelge «det eneste» fund (Skrivevagt ser stoppedeTidligt). + stoppedeTidligt = true + vaultSprunget.append("\(app.localizedName ?? ""): \(vaultRolleGrund)"); continue } // Vault-porten (5/11): intet fra en adgangskode-side - hverken den eller noget under den. if let g = vaultGrund(el, rolle: r) { vaultSprunget.append("\(app.localizedName ?? ""): \(g)"); continue } diff --git a/helper/Sources/cmcp-helper/main.swift b/helper/Sources/cmcp-helper/main.swift index 34a51ed0..57dfcc28 100644 --- a/helper/Sources/cmcp-helper/main.swift +++ b/helper/Sources/cmcp-helper/main.swift @@ -488,7 +488,9 @@ case "inspect": } if AX.stoppedeTidligt { svar["stopped_early"] = true - svar["note"] = "The walk stopped after \(Int(AX.tidsgraense)) seconds - this app answers slowly, so this is PART of the tree, not all of it. Narrow it with find, or a lower depth." + svar["note"] = AX.tidSlut + ? "The walk stopped after \(Int(AX.tidsgraense)) seconds - this app answers slowly, so this is PART of the tree, not all of it. Narrow it with find, or a lower depth." + : "Part of this browser's tree could not be read (a role lookup failed), so it was left out; this is PART of the tree, not all of it." } // R2 (Opus N7): inspect havde intet signal for en Chrome-side der stadig bygges - samme som find. if AX.chromeTaendtNu || AX.chromeSideUlaeselig(scope: args.str("app")) { @@ -519,7 +521,9 @@ case "find": // ⛔ R23 (Astra): et tidsudloeb lignede et tomt program ({count: 0}). Nu siges det. if AX.stoppedeTidligt { fundSvar["stopped_early"] = true - fundSvar["note"] = [fundSvar["note"] as? String, "The search stopped after \(Int(AX.tidsgraense)) seconds - this app answers slowly, so these are the matches in PART of it, not all. Narrow it with role, subrole, title or a lower depth."].compactMap { $0 }.joined(separator: " ") + fundSvar["note"] = [fundSvar["note"] as? String, AX.tidSlut + ? "The search stopped after \(Int(AX.tidsgraense)) seconds - this app answers slowly, so these are the matches in PART of it, not all. Narrow it with role, subrole, title or a lower depth." + : "Part of this browser's tree could not be read (a role lookup failed) and was left out, so these are not all matches; a write will not pick one on its own."].compactMap { $0 }.joined(separator: " ") } // ⛔ MAALT 4/11: kaldet der taendte Chromes web-trae, saa 0 - traeet kom 3-15 s senere. if hits.isEmpty && (AX.chromeTaendtNu || AX.chromeSideUlaeselig(scope: args.str("app"))) { diff --git a/mcp-server/index.js b/mcp-server/index.js index c862766c..836b7482 100644 --- a/mcp-server/index.js +++ b/mcp-server/index.js @@ -273,9 +273,10 @@ seconds; a search that finds nothing while a Chrome page is not readable yet say so (\`tree_building\`), and until it is built, that Chrome window is blacked out whole in screenshots. Read again before you conclude a page is empty. Password managers inside a browser (the browser's own password page, a known web vault or -password-manager extension) are never returned, and a click there is refused, like the -native apps: an answer that says skipped_password_pages, password_page or denied left -one out on purpose - do not try to read or click it another way; ask the person instead. +password-manager extension) are never returned, typing there is refused, and a click +there is refused (named app) or needs the person (no app named), like the native apps: +an answer that says skipped_password_pages, password_page or denied left one out on +purpose - do not try to read or click it another way; ask the person instead. When a browser tool is also in this session (Browser MCP's browser_*), let it do the work inside pages, and take over where it is refused: Chrome blocks EVERY extension on Chrome Web Store and its developer console ("The extensions gallery @@ -2199,15 +2200,21 @@ async function haandterKald(request) { // - et klik der pegede paa Attach ved dommen og paa Send under laasen, gik // igennem. Nu doemmes der ALTID igen hvor noget kan sende, og dommen skal // vaere den samme: hvem, hvad og om det sender. + // ⛔ R6 (Astra, MAALT i hukommelsen): adgangskode-genkontrollen laa INDE i beskedSlags - serverens browserliste er + // kortere end hjaelperens (Chrome Beta, Chrome for Testing, Firefox Nightly gik uden genkontrol). Nu for ALLE + // app-klik: skiftede punktet til en adgangskode-side, mens der blev ventet, klikkes der ikke. + if (appKlik && name === 'computer_click') { + let nuKlik = null; + try { nuKlik = await callHelper(['at', '--app', appVaerdi(args, targetBundleId), '--x', String(args.x), '--y', String(args.y)], { timeout: 8000 }); } catch {} + if (!nuKlik?.found) return 'what is under that point could not be checked again just before the click'; + if (nuKlik.password_page) return 'the point is now inside a password manager page, which is never clicked by an agent'; + } if (beskedSlags(targetBundleId)) { // R27: et klik med `app` genmaales I maalprogrammet, ligesom det blev doemt. let igenKlik = null; if (appKlik) { try { igenKlik = await callHelper(['at', '--app', appVaerdi(args, targetBundleId), '--x', String(args.x), '--y', String(args.y)], { timeout: 8000 }); } catch {} if (!igenKlik?.found || igenKlik.window_number !== appKlik.window_number) return 'the window under that point in the app changed while the agent waited'; - // R5 (Astra, MAALT i hukommelsen): genkontrollen saa kun vinduet - skiftede samme vindue til en adgangskode-side - // mens der blev ventet, gik klikket igennem. Nu gaelder samme afvisning som i foerste kontrol. - if (igenKlik.password_page) return 'the point is now inside a password manager page, which is never clicked by an agent'; } const igen = await sendeDom(name, args, targetBundleId, igenKlik); if (JSON.stringify(igen ?? null) !== JSON.stringify(sende ?? null)) { diff --git a/test/chrome-vault-live.mjs b/test/chrome-vault-live.mjs index 2b355591..0fec5716 100644 --- a/test/chrome-vault-live.mjs +++ b/test/chrome-vault-live.mjs @@ -37,6 +37,16 @@ const M = `CMCPVAULT${Date.now().toString(36).toUpperCase()}`; // Indholdets markoer staar KUN paa siden, aldrig i titlen: fanen og vinduet baerer sidens titel (metadata, ikke skjult - som for programmer). const I = `INDHOLD${Math.random().toString(36).slice(2, 10).toUpperCase()}`; +// ⛔ R6 (Astra, MAALT med syntetiske svar): grunden «password manager page», skipped_password_pages og denied gives +// pr. PROGRAM, ikke pr. vindue - et ANDET Chrome-vindue med en adgangskode-side kunne give proeven dens groenne svar. +// Derfor foerst: intet andet Chrome-vindue maa vise en adgangskode-side. Ellers beviser proeven intet. +{ + const foer = hj(['secure-rects', '--app', 'com.google.Chrome']); + const fremmed = (foer.whole_window || []).some((g) => /password manager page/.test(g)); + const ff = hj(['find', '--app', 'com.google.Chrome', '--contains', 'ZZZCMCPINGENTINGZZZ', '--depth', '30']); + if (fremmed || (ff.skipped_password_pages || []).length) spring('et andet Chrome-vindue viser allerede en adgangskode-side - proevens svar kunne komme derfra'); +} + // Selvsigneret certifikat til vault.bitwarden.com - kun i en engangs-mappe. const mappe = mkdtempSync(join(tmpdir(), 'cmcp-chrome-vault-')); execFileSync('/usr/bin/openssl', ['req', '-x509', '-newkey', 'rsa:2048', '-nodes', '-days', '1', '-subj', '/CN=vault.bitwarden.com', diff --git a/test/vault-adresse.mjs b/test/vault-adresse.mjs index 16ef2c5b..91b31b58 100644 --- a/test/vault-adresse.mjs +++ b/test/vault-adresse.mjs @@ -20,6 +20,7 @@ const ER = [ 'edge://settings/passwords', 'edge://settings/autofill/passwords/checkup', 'brave://password-manager/passwords', 'brave://settings/passwords', 'opera://settings/passwords', 'vivaldi://settings/passwords', 'vivaldi://password-manager/settings', 'about:logins', 'about:logins?filter=x', 'extension://nngceckbapebfimnlniiiahkandclblb/popup/index.html', + 'chrome-extension://nngceckbapebfimnlniiiahkandclblb', 'https://keepersecurity.com/vault', 'https://passwords.google.com/intro-private', // web-hvaelv 'https://my.1password.com/vaults', 'https://agent360.1password.eu/', 'https://start.1password.com/signin', 'https://team.1password.ca/', 'https://vault.bitwarden.com/#/vault', 'https://vault.bitwarden.eu/', 'https://app.dashlane.com/', 'https://pass.proton.me/', @@ -43,6 +44,9 @@ const ER_IKKE = [ 'chrome://settings/', 'chrome://newtab/', 'chrome-extension://abcdefghijklmnopabcdefghijklmnop/popup.html', 'about:blank', 'https://www.google.com/search?q=1password', 'chrome://password-manager-ikke', 'about:loginsx', 'extension://abcdefghijklmnopabcdefghijklmnop/x.html', 'moz-extension://nngceckbapebfimnlniiiahkandclblb/', + // R6 (Astra): graenser efter id og sti + 'extension://nngceckbapebfimnlniiiahkandclblb.example/popup.html', 'https://keepersecurity.com/vaulting', + 'https://lastpass.com/vaultx/', ]; for (const u of ER) { if (sp(u) === true) ok++; else { fejl++; console.log(`DUMP genkendes ikke: ${u}`); } } for (const u of ER_IKKE) { if (sp(u) === false) ok++; else { fejl++; console.log(`DUMP genkendes forkert: ${u}`); } } From 8fd733f48912f7e57e85f209d0646f66515c86b6 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Thu, 5 Nov 2026 11:43:52 +0100 Subject: [PATCH 56/94] Efter R7 (Astra IKKE GODKENDT paa scripts + vault-binding, Opus GODKENDT MED RETTELSER): proeverne binder deres grunde, klik-genkontrollen har en proeve, og en genkendt adgangskode-side spoerger i stedet for et Send-afslag - vault- og dybde-proeven: praecis grund-ordlyd og en efterkontrol naar proevens Chrome er lukket (signalerne skal gaa med den) - side-proevens trin 5 melder roedt i stedet for at gaa ned (M3) - bundet-maal 12a-12e: genkontrollen for alle app-klik; klik uden app paa en GENKENDT vault-side spoerger personen, en side der ikke kunne afgoeres beholder sende-dommen; mutationsbevist (genkontrol, sendedom, note) - claims-offline: at-notens ordlyd og serverens moenster i takt - servertekst: intet 'Call it again' paa en adgangskode-side - flader: adresse-reglen gaelder websider i alle programmer; testloeftet; fanegruppe-maalingen navngivet - hjaelperens kilde er uaendret (kandidaten 3934b38b passer stadig) Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 14 +++++--- README.md | 17 ++++++---- docs/llms.txt | 4 ++- docs/security.html | 2 +- mcp-server/README.md | 17 ++++++---- mcp-server/index.js | 15 +++++++-- test/bundet-maal.mjs | 60 +++++++++++++++++++++++++++++++++++ test/chrome-dyb-side-live.mjs | 25 +++++++++++---- test/chrome-side-live.mjs | 11 +++++-- test/chrome-vault-live.mjs | 40 +++++++++++++++++------ test/claims-offline.mjs | 8 +++++ 11 files changed, 173 insertions(+), 40 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index a0e6e385..dab6106b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -57,8 +57,11 @@ in Chrome and Edge - each id checked against Chrome Web Store or Edge Add-ons on is never returned by `computer_find`, `computer_inspect`, `computer_focused` or the click gate's lookup (the answer says what was left out), its window is blacked out whole in screenshots, typing (also the direct accessibility route) is refused, and a click is -refused (without an app named, which needs foreground mode, it asks every time). A page -whose address or role cannot be read in a browser counts as one that cannot be ruled out. +refused (without an app named, which needs foreground mode, it asks every time - the send +gate no longer mistakes such a page, with its empty title, for a chat: `test/bundet-maal.mjs` +12d; a page that could not be checked might be a web chat, and keeps the send gate: 12e). A web page whose address cannot be read - in any app, since the address rule applies +to web areas everywhere - or an element whose role cannot be read in a browser counts as +one that cannot be ruled out. `version` lists `browser-password-pages`; `vault-url --url` answers the address rule on its own, and `test/vault-adresse.mjs` checks every entry both ways (two mutants turn it red). Rules with no behavioural test of their own (read in the code, not measured): the page @@ -68,14 +71,17 @@ channels, the size rule regardless of role, the role and app checks in the focus the two small-window rules - Chrome makes `window.open` popups at least 520x446 (measured), so no test can reach a smaller one - the role checks that skip a browser branch in find and inspect (and mark the answer incomplete, so a write never picks the one match left), the -empty role in a password-page answer for older servers, and the click gate's recheck. The check sits on the +and the empty role in a password-page answer for older servers. The click gate's recheck +just before the click has a test of its own (`test/bundet-maal.mjs` 12a-12c: an unchanged +point is clicked, a point that became a password page or cannot be looked up again is not; +two mutants turn it red). The check sits on the web area, not the window, so a suggestion menu inside another page is covered too, and it applies in any browser that exposes the address (extension pages: Chrome and Edge only). Not covered: self-hosted vaults, unlisted extensions, Safari's and Firefox's extension pages, window and menu titles (as for native apps), Chrome's own password bubbles and autofill rows (native panels, not pages), screen recordings, and a vault navigated away from in the instant between capture and scan. It is a guard against accidents, not a fence: non-text keys, -developer tools and the clipboard are not covered. Test: `test/chrome-vault-live.mjs` against a real vault address (`https://vault.bitwarden.com`, served locally over HTTPS and pointed at with `--host-resolver-rules`; Chrome does not open its own password page from the command line). +developer tools and the clipboard are not covered. Test: `test/chrome-vault-live.mjs` against a real vault address (`https://vault.bitwarden.com`, served locally over HTTPS and pointed at with `--host-resolver-rules`; Chrome does not open its own password page from the command line). The signals are per app, not per window, so the test refuses to measure when another Chrome window already shows a password page, matches the vault reason's exact wording (not the "role could not be read" reason), and after closing its own Chrome checks that the signals went with it - if they did not, it is red. `test/chrome-dyb-side-live.mjs` binds its depth reason the same way. **The screen without a question, if you want it.** Set `CMCP_SCREEN_ASK=0` and an agent that needs the screen borrows it with no question and no Touch ID - at once, or diff --git a/README.md b/README.md index e65979fb..75587516 100644 --- a/README.md +++ b/README.md @@ -165,9 +165,10 @@ and that its chain holds. ``` -Each gate has a test, and the tests were mutation-checked when they were written: -break the code on purpose and the test goes red. Where a mutant survives or a rule -has no test of its own, the CHANGELOG says which and why. See [Testing](#testing). +Most gates have a test, mutation-checked when it was written: break the code on +purpose and the test goes red. Not every rule has one - the CHANGELOG lists the +rules without a test of their own and the mutants that survive, and why. See +[Testing](#testing). ## Install @@ -534,8 +535,11 @@ sit unnoticed until it expires. That is a real limitation today, not a setting. `computer_find`, `computer_inspect`, `computer_focused` or the click gate, its window is blacked out whole in screenshots, typing there is refused, and a click there is refused (or, without an app named, which needs foreground mode, asks - every time) - like password manager apps. A page whose address or role cannot be - read in a browser is kept out of the reading tools too. + every time) - like password manager apps. The address rule applies to a web page + in any app, not only in a browser. A web page whose address cannot be read (in any + app), or an element whose role cannot be read in a browser, is kept out of the + reading tools too - that can also leave out ordinary content, and then a search + says it was incomplete instead of guessing. It is a guard against accidents, not a fence: keys that are not text (Tab, Enter, Cmd+C), surfaces that copy a page elsewhere (developer tools, reading mode, the clipboard) and Chrome's OWN password bubbles and autofill rows - native panels, @@ -548,7 +552,8 @@ sit unnoticed until it expires. That is a real limitation today, not a setting. cannot be scripted") - there a browser tool can navigate but not act, and this server can read the page (measured on the developer console). An agent finds the right window by the browser tool's tab group: the window title contains the - group's name, in Chrome's own interface language. + group's name, in Chrome's own interface language (measured by hand once, in a + Danish Chrome: «… – en del af gruppen Claude 2 – …»; no automated test). - **Keystrokes do not land in a Chromium window that is not focused.** Measured the same day: the helper reported `typed: 21` and `took_screen: false`, and the text arrived nowhere. `computer_set_value` through the accessibility diff --git a/docs/llms.txt b/docs/llms.txt index f40d7493..323c5b98 100644 --- a/docs/llms.txt +++ b/docs/llms.txt @@ -116,7 +116,9 @@ under a friendlier name. (the browser's own password page, known web vaults, eighteen known extensions - also as a suggestion menu in another page) are never returned by find, inspect or focused, their window is blacked out whole, typing there is refused, and a click there is - refused or asks every time, like password manager apps. A guard against accidents, + refused or asks every time, like password manager apps. The address rule applies to + a web page in any app; a page whose address, or a browser element whose role, cannot + be read is left out too (a search then says it was incomplete). A guard against accidents, not a fence: Chrome's own password bubbles and autofill rows, non-text keys, developer tools, the clipboard, window and menu titles, a self-hosted vault, unlisted or Safari/Firefox extensions are not covered; screen recordings leave out diff --git a/docs/security.html b/docs/security.html index 8bad15e9..6c6daf18 100644 --- a/docs/security.html +++ b/docs/security.html @@ -199,7 +199,7 @@

Gate 1 - redaction happens before the file exists

Had we written the file first and redacted after, there would be a window - short, but real - where an unredacted picture of your desktop sat on disk for any other process to read. A security property with a race in it is not a security property.

Two things get painted:

    -
  • Secure text fields. Native fields expose the role AXSecureTextField. Fields in a web page expose the role AXTextField with the subrole AXSecureTextField. Checking only the role catches native fields and lets every browser password box through - which is the case that actually matters. We check both. A field in a web page is only visible once the browser shows its page to the accessibility layer: in Chrome this server switches that on (the switch a screen reader uses), and while a Chrome window's page is not readable yet - still being built, 3 to 15 seconds after it is first switched on, measured on Chrome 156, or empty - the whole window is painted over instead. Not covered: Safari, Firefox, Chromium browsers we do not name, Chrome app windows, and any browser when CMCP_INGEN_ELECTRON=1 is set. Known gaps, not measured: a field in a cross-site frame, or a login step that appears before Chrome has updated its tree. Password managers inside a browser are treated like native ones: a page whose address is the browser's own password page, a known web vault or one of eighteen known password-manager extensions in Chrome and Edge (also as a suggestion menu inside another page) is never returned by the reading tools, its window is blacked out whole, typing there is refused, and a click there is refused (or, without an app named, which needs foreground mode, asks every time) - like password manager apps; a page whose address or role cannot be read in a browser is kept out of the reading tools too. Not recognised: a self-hosted vault, an unlisted extension, Safari's and Firefox's extension pages. Not hidden: window and menu titles (as for native apps), screen recordings, and Chrome's own password bubbles and autofill rows, which are native panels rather than pages. It is a guard against accidents, not a fence: keys that are not text, developer tools and the clipboard are not covered.
    • +
  • Secure text fields. Native fields expose the role AXSecureTextField. Fields in a web page expose the role AXTextField with the subrole AXSecureTextField. Checking only the role catches native fields and lets every browser password box through - which is the case that actually matters. We check both. A field in a web page is only visible once the browser shows its page to the accessibility layer: in Chrome this server switches that on (the switch a screen reader uses), and while a Chrome window's page is not readable yet - still being built, 3 to 15 seconds after it is first switched on, measured on Chrome 156, or empty - the whole window is painted over instead. Not covered: Safari, Firefox, Chromium browsers we do not name, Chrome app windows, and any browser when CMCP_INGEN_ELECTRON=1 is set. Known gaps, not measured: a field in a cross-site frame, or a login step that appears before Chrome has updated its tree. Password managers inside a browser are treated like native ones: a page whose address is the browser's own password page, a known web vault or one of eighteen known password-manager extensions in Chrome and Edge (also as a suggestion menu inside another page) is never returned by the reading tools, its window is blacked out whole, typing there is refused, and a click there is refused (or, without an app named, which needs foreground mode, asks every time) - like password manager apps. The address rule applies to a web page in any app, not only a browser; a page whose address, or a browser element whose role, cannot be read is kept out of the reading tools too, and a search then says it was incomplete. Not recognised: a self-hosted vault, an unlisted extension, Safari's and Firefox's extension pages. Not hidden: window and menu titles (as for native apps), screen recordings, and Chrome's own password bubbles and autofill rows, which are native panels rather than pages. It is a guard against accidents, not a fence: keys that are not text, developer tools and the clipboard are not covered.
  • Whole windows of listed apps. Keychain Access, 1Password, Bitwarden, LastPass, Dashlane, Apple Passwords. We do not walk into those windows to decide what to hide; descending into a vault to work out what is secret is the mistake we are avoiding.

The rectangles are painted solid black, not blurred or pixelated. A good enough model can read through pixelation. It cannot read through black.

diff --git a/mcp-server/README.md b/mcp-server/README.md index 30d7e416..dff3b415 100644 --- a/mcp-server/README.md +++ b/mcp-server/README.md @@ -163,9 +163,10 @@ and that its chain holds. ``` -Each gate has a test, and the tests were mutation-checked when they were written: -break the code on purpose and the test goes red. Where a mutant survives or a rule -has no test of its own, the CHANGELOG says which and why. See [Testing](#testing). +Most gates have a test, mutation-checked when it was written: break the code on +purpose and the test goes red. Not every rule has one - the CHANGELOG lists the +rules without a test of their own and the mutants that survive, and why. See +[Testing](#testing). ## Install @@ -532,8 +533,11 @@ sit unnoticed until it expires. That is a real limitation today, not a setting. `computer_find`, `computer_inspect`, `computer_focused` or the click gate, its window is blacked out whole in screenshots, typing there is refused, and a click there is refused (or, without an app named, which needs foreground mode, asks - every time) - like password manager apps. A page whose address or role cannot be - read in a browser is kept out of the reading tools too. + every time) - like password manager apps. The address rule applies to a web page + in any app, not only in a browser. A web page whose address cannot be read (in any + app), or an element whose role cannot be read in a browser, is kept out of the + reading tools too - that can also leave out ordinary content, and then a search + says it was incomplete instead of guessing. It is a guard against accidents, not a fence: keys that are not text (Tab, Enter, Cmd+C), surfaces that copy a page elsewhere (developer tools, reading mode, the clipboard) and Chrome's OWN password bubbles and autofill rows - native panels, @@ -546,7 +550,8 @@ sit unnoticed until it expires. That is a real limitation today, not a setting. cannot be scripted") - there a browser tool can navigate but not act, and this server can read the page (measured on the developer console). An agent finds the right window by the browser tool's tab group: the window title contains the - group's name, in Chrome's own interface language. + group's name, in Chrome's own interface language (measured by hand once, in a + Danish Chrome: «… – en del af gruppen Claude 2 – …»; no automated test). - **Keystrokes do not land in a Chromium window that is not focused.** Measured the same day: the helper reported `typed: 21` and `took_screen: false`, and the text arrived nowhere. `computer_set_value` through the accessibility diff --git a/mcp-server/index.js b/mcp-server/index.js index 836b7482..8196247c 100644 --- a/mcp-server/index.js +++ b/mcp-server/index.js @@ -712,7 +712,10 @@ async function sendeDom(name, args, bid, appKlik = null) { } else if (name === 'computer_click') { const d = appKlik || await callHelper(['at', '--x', String(args.x), '--y', String(args.y)], { timeout: 8000 }); kontrolSvar = { navne: [d.title, d.description], rolle: d.role, vindue: d.window || null, ramme: d.frame || null, - fundet: !!d.found, andetProgram: d.bundleId !== bid }; + fundet: !!d.found, andetProgram: d.bundleId !== bid, + // KUN en genkendt adgangskode-side (hjaelperens note, main.swift `at`). En side hvis adresse ikke + // kunne laeses, er ogsaa password_page (fejl-lukket) - den kan vaere en webchat, og beholder sende-dommen. + adgangskodeSide: d.password_page === true && /^The point is inside a password manager page;/.test(String(d.note || '')) }; } else kontrolSvar = null; } catch { kontrolSvar = { fejl: true }; } return kontrolSvar; @@ -723,6 +726,11 @@ async function sendeDom(name, args, bid, appKlik = null) { if (slags === 'browser') { const t = await callHelper(['samtale', '--app', appVaerdi(args, bid), '--title-only'], { timeout: 8000 }).catch(() => ({})); const k = await kontrol(); + // ⛔ R7 (Astra + Opus, MAALT i test/bundet-maal.mjs 12d): et punkt i en GENKENDT adgangskode-side har tom titel og tomt + // vindue (hjaelperen udleverer intet derfra), og blev her doemt som en chat - et haardt Send-afslag uden mening. Siden + // er ingen besked; knapErFarlig doemmer den farlig, saa personen spoerges, som ved et adgangskode-program. En side + // der ikke kunne afgoeres (12e), doemmes stadig her, fejl-lukket. + if (k?.adgangskodeSide) return null; // Runde 5 (Astra 2, Fable 1): en kontrol hvis vindue ikke kan laeses, er et ukendt // vindue - det doemmes som den fokuserede titel doemmes: fejl-lukket, som en chat. const titler = [String(t.window || '').trim(), ...(k ? [k.fejl ? '' : String(k.vindue || '').trim()] : [])]; @@ -2207,7 +2215,7 @@ async function haandterKald(request) { let nuKlik = null; try { nuKlik = await callHelper(['at', '--app', appVaerdi(args, targetBundleId), '--x', String(args.x), '--y', String(args.y)], { timeout: 8000 }); } catch {} if (!nuKlik?.found) return 'what is under that point could not be checked again just before the click'; - if (nuKlik.password_page) return 'the point is now inside a password manager page, which is never clicked by an agent'; + if (nuKlik.password_page) return 'the point is now inside a password manager page, which is never clicked by an agent - ask the person to do this step with computer_ask_user'; } if (beskedSlags(targetBundleId)) { // R27: et klik med `app` genmaales I maalprogrammet, ligesom det blev doemt. @@ -2357,7 +2365,8 @@ async function haandterKald(request) { if (kaldStoppet()) return errorResult(`Stopped: ${stopgrund}. Ask them in the chat before you continue.`); // R3 (Astra): har mennesket taget skaermen fra agenten, er svaret et stop - uanset hvilken kontrol der afviste foerst. if (stopTilbage || nyligtTagetTilbage()) return errorResult(`Refused: ${stopTilbage ? stopgrund : `${tagetTilbageTekst()}, so it was not done`}. Nothing was done. ${TILBAGE_STOP}`); - return errorResult(`${stopVenter ? 'Waiting' : 'Refused'}: ${stopgrund}. Nothing was done. Call it again.`); + // R7 (Opus O7): en adgangskode-side bliver ikke anderledes af et nyt kald - «Call it again» sendte agenten i ring. + return errorResult(`${stopVenter ? 'Waiting' : 'Refused'}: ${stopgrund}. Nothing was done.${/password manager page/.test(stopgrund) ? '' : ' Call it again.'}`); } if (!laast.ok) { // laast.grund er sat naar laasen fejlede LUKKET paa en infra-fejl (M1); diff --git a/test/bundet-maal.mjs b/test/bundet-maal.mjs index cc883c00..814e89d6 100644 --- a/test/bundet-maal.mjs +++ b/test/bundet-maal.mjs @@ -439,5 +439,65 @@ for (const [nr, tekst, args, rolle] of [ srv.kill(); } +// 12 · R7 (Opus, MAALT med egen attrap): genkontrollen lige foer klikket gaelder ALLE app-klik - ogsaa et +// program der ikke er en browser (Notes). Foerste «at --app» doemmer punktet, det naeste er genkontrollen +// under laasen; attrappen svarer i raekkefoelge. 12a kalibrerer: et uaendret punkt klikkes stadig. +{ + const OK = { found: true, app: 'Notes', bundleId: 'com.apple.Notes', pid: 3303, role: 'AXButton', title: 'OK', description: '', window: 'Note', window_number: 777, under: ['com.apple.finder'] }; + const VAULT = { ...OK, role: '', title: '', description: '', window: '', password_page: true, note: 'a password manager page' }; + const ULAESELIG = { found: false, under: [], why: 'the point could not be read' }; + for (const [id, hvad, anden, skalKlikke, moenster] of [ + ['12a', 'punktet er uaendret: klikket sendes (genkontrollen spaerrer ikke et almindeligt klik)', OK, true, null], + ['12b', 'punktet er nu i en adgangskode-side: intet klik, og svaret beder agenten spoerge personen - ikke «kald igen»', VAULT, false, /now inside a password manager page/], + ['12c', 'punktet kan ikke slaas op igen: intet klik', ULAESELIG, false, /could not be checked again just before the click/], + ]) { + const { srv, rpc, kald, hj } = klient({ apps: APPS8, at: OK, 'at --app': { _raekke: [OK, anden] } }); + await rpc('initialize', { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'bundet', version: '1' } }); + const r = await kald('computer_click', { app: 'Notes', x: 10, y: 20 }); + const klik = hj.kald().filter(k => k.argv[0] === 'click'); + const atApp = hj.kald().filter(k => k.argv[0] === 'at' && k.argv.includes('--app')); + const ok = skalKlikke ? (klik.length === 1 && atApp.length >= 2) + : (klik.length === 0 && r.fejl && moenster.test(r.tekst) && (id !== '12b' || (!/Call it again/.test(r.tekst) && /ask the person/.test(r.tekst)))); + check(`${id} genkontrollen (Notes, ikke en browser): ${hvad}`, ok, `klik ${klik.length} · at --app ${atApp.length} · ` + r.tekst.slice(0, 200)); + srv.kill(); + } +} +// 12d · R6/R7 (Astra + Opus): et klik UDEN app paa en adgangskode-side i Chrome skal spoerge personen, som et +// adgangskode-program. Siden har tom titel og tomt vindue, og sende-dommen tog den for en chat og afviste +// haardt med en Send-tekst, der intet havde med sagen at goere. Forgrund, saa spoergsmaalet kan taelles. +{ + // Noten i hjaelperens ordlyd (main.swift `at`): «The point is inside ; nothing from it is returned.» + const VAULT = { found: true, app: 'Google Chrome', bundleId: 'com.google.Chrome', pid: 400, role: '', title: '', description: '', window: '', password_page: true, note: 'The point is inside a password manager page; nothing from it is returned.', under: ['com.google.Chrome'] }; + const { srv, rpc, kald, hj, spoerger } = klient({ + apps: { apps: [{ name: 'Google Chrome', bundleId: 'com.google.Chrome', pid: 400, active: false }, + { name: 'Finder', bundleId: 'com.apple.finder', pid: 300, active: true }] }, + at: VAULT, samtale: { window: 'Vault' } }, { CMCP_BACKGROUND: '0' }); + await rpc('initialize', { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'bundet', version: '1' } }); + const r = await kald('computer_click', { x: 10, y: 20 }); + const klik = hj.kald().filter(k => k.argv[0] === 'click'); + check('12d klik uden app paa en adgangskode-side i Chrome: personen spoerges, intet Send-afslag, intet klik uden ja', + klik.length === 0 && spoerger.gangeSpurgt() === 1 && !/Send control|Nothing was sent|was not sent/.test(r.tekst), + `klik ${klik.length} · spurgt ${spoerger.gangeSpurgt()} · ` + r.tekst.slice(0, 200)); + srv.kill(); +} + +// 12e · Modstykket: en side hvis adresse IKKE kunne laeses, er ogsaa password_page (fejl-lukket) - men den kan vaere en +// webchat. Den maa ikke slippe uden om sende-dommen og blive et almindeligt «farligt klik», hvor personen godkender +// uden at se modtager og tekst. Sende-dommen skal stadig afvise (som foer 12d-rettelsen). +{ + const UKENDT = { found: true, app: 'Google Chrome', bundleId: 'com.google.Chrome', pid: 400, role: '', title: '', description: '', window: '', password_page: true, note: 'The point is inside an element in a browser whose page could not be checked; nothing from it is returned.', under: ['com.google.Chrome'] }; + const { srv, rpc, kald, hj, spoerger } = klient({ + apps: { apps: [{ name: 'Google Chrome', bundleId: 'com.google.Chrome', pid: 400, active: false }, + { name: 'Finder', bundleId: 'com.apple.finder', pid: 300, active: true }] }, + at: UKENDT, samtale: { window: 'WhatsApp' } }, { CMCP_BACKGROUND: '0' }); + await rpc('initialize', { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'bundet', version: '1' } }); + const r = await kald('computer_click', { x: 10, y: 20 }); + const klik = hj.kald().filter(k => k.argv[0] === 'click'); + check('12e en side der ikke kunne afgoeres (maaske en webchat): sende-dommen afviser stadig, ingen spurgt, intet klik', + klik.length === 0 && spoerger.gangeSpurgt() === 0 && r.fejl && /Send control|Nothing was sent/.test(r.tekst), + `klik ${klik.length} · spurgt ${spoerger.gangeSpurgt()} · ` + r.tekst.slice(0, 200)); + srv.kill(); +} + console.log(fails.length ? `DUMPET: ${fails.length} tjek` : 'Alle tjek bestået.'); process.exit(fails.length ? 1 : 0); diff --git a/test/chrome-dyb-side-live.mjs b/test/chrome-dyb-side-live.mjs index 5c54c3b7..636bc741 100644 --- a/test/chrome-dyb-side-live.mjs +++ b/test/chrome-dyb-side-live.mjs @@ -34,20 +34,29 @@ import { fileURLToPath } from 'node:url'; const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..'); const H = process.env.CMCP_HELPER || join(ROOT, 'mcp-server', 'vendor', 'cmcp-helper'); const CHROME = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'; -if (!existsSync(CHROME)) { console.log('SPRUNGET OVER: 5 (Google Chrome er ikke installeret her) - bevist intet, ikke bestaaet'); process.exit(0); } +if (!existsSync(CHROME)) { console.log('SPRUNGET OVER: 6 (Google Chrome er ikke installeret her) - bevist intet, ikke bestaaet'); process.exit(0); } // ⛔ MAALT 5/11 kl. 02.09: mens Mac'en er LAAST, bygger Chrome ikke siders tilgaengeligheds-trae. // Et maaleprogram uden hjaelperen fandt 0 web-omraader efter 25,6 s paa en frisk Chrome (laast), // mod 2,1 s kl. 01.20 (ulaast). Proeven maaler da laasen, ikke koden - saa den siger UMAALT. { const io = execFileSync('ioreg', ['-n', 'Root', '-d1'], { encoding: 'utf8' }); - if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) { console.log('SPRUNGET OVER: 5 (skaermen er laast - Chrome bygger ingen sider imens) - bevist intet, ikke bestaaet'); process.exit(0); } + if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) { console.log('SPRUNGET OVER: 6 (skaermen er laast - Chrome bygger ingen sider imens) - bevist intet, ikke bestaaet'); process.exit(0); } } // ⛔ MAALT 5/11 08.21: Chrome henter sig selv frem trods `open -g`. Kun naar personen ikke arbejder. -if (inaktivSek() < MIN_INAKTIV) { console.log(`SPRUNGET OVER: 5 (personen arbejder lige nu - inaktiv ${Math.round(inaktivSek())} s; en ny Chrome henter sig selv frem foran dem) - bevist intet, ikke bestaaet`); process.exit(0); } +if (inaktivSek() < MIN_INAKTIV) { console.log(`SPRUNGET OVER: 6 (personen arbejder lige nu - inaktiv ${Math.round(inaktivSek())} s; en ny Chrome henter sig selv frem foran dem) - bevist intet, ikke bestaaet`); process.exit(0); } let fejl = 0; const check = (navn, ok, hvorfor) => { console.log(`${ok ? 'OK ' : 'DUMP'} ${navn}${ok ? '' : ' - ' + hvorfor}`); if (!ok) fejl++; }; const hj = (args, stdin) => JSON.parse(execFileSync(H, args, { input: stdin, encoding: 'utf8', timeout: 60000 })); +// R7 (Astra, S): grunden «deeper than the scan reaches» gives pr. PROGRAM - et andet Chrome-vindue kunne give tjek 3 +// dets groenne svar. Nu: ingen saadan grund foer proevens Chrome starter (ellers springes over), og ingen efter at den +// er lukket (ellers roed, Y). Grunden matches i sin praecise form. +const DYB = /\(its page went deeper than the scan reaches - window blacked out whole\)$/; +const dybSignaler = () => (hj(['secure-rects', '--app', 'com.google.Chrome']).whole_window || []).filter((g) => DYB.test(g)); +{ + const foer = dybSignaler(); + if (foer.length) { console.log(`SPRUNGET OVER: 6 (et andet Chrome-vindue svaertes allerede af dybde-grunden - proevens svar kunne komme derfra) - bevist intet, ikke bestaaet`); process.exit(0); } +} const vent = (ms) => new Promise((r) => setTimeout(r, ms)); const mappe = mkdtempSync(join(tmpdir(), 'cmcp-chrome-')); @@ -93,10 +102,14 @@ try { const r = sr.rects.filter(iVinduet); // ⛔ R2 (Astra): et hele-vindue-rektangel kan have en ANDEN grund. Kraev dybde-grunden. check('3. et felt sloeringen ikke naar, svaerter HELE vinduet - af netop den grund', - r.some(heleVinduet) && (sr.whole_window || []).some((g) => /deeper than the scan reaches/.test(g)), + r.some(heleVinduet) && (sr.whole_window || []).some((g) => DYB.test(g)), `rekt ${JSON.stringify(r)} grunde ${JSON.stringify(sr.whole_window)}`); } finally { - check('Z. proevens Chrome er lukket igen', chrome.stop(), 'den lever stadig - naeste proeve ville maale dens vinduer'); + const lukket = chrome.stop(); + check('Z. proevens Chrome er lukket igen', lukket, 'den lever stadig - naeste proeve ville maale dens vinduer'); + let efter = ['efterkontrollen kunne ikke koeres (proevens Chrome lever)']; + if (lukket) { try { efter = dybSignaler(); } catch (e) { efter = [`efterkontrollen fejlede: ${String(e).slice(0, 80)}`]; } } + check('Y. dybde-grunden forsvandt med proevens Chrome (den kom derfra, ikke fra et andet vindue)', efter.length === 0, JSON.stringify(efter)); ryd(); } -process.exit(slutDom(fejl, 5, START_MS)); +process.exit(slutDom(fejl, 6, START_MS)); diff --git a/test/chrome-side-live.mjs b/test/chrome-side-live.mjs index 1e90dfb1..57f01f8c 100644 --- a/test/chrome-side-live.mjs +++ b/test/chrome-side-live.mjs @@ -102,9 +102,14 @@ try { r4.length >= 1 && !r4.some(heleVinduet) && r4.some((r) => r.w < 400 && r.h < 60), JSON.stringify(r4)); // 5. Skrivning bekraeftes og laeses tilbage. - const s5 = hj(['set-value', '--match-stdin', '--app', 'com.google.Chrome', '--role', 'AXTextArea'], - JSON.stringify({ contains: 'CMCPLIVEFELT', text: 'skrevet af proeven' })); - const tilbage = hj(['find', '--app', 'com.google.Chrome', '--contains', 'CMCPLIVEFELT', '--role', 'AXTextArea', '--depth', '60']); + // R7 (Opus O1, MAALT): fejlede set-value (exit 1), kastede kaldet, og proeven gik ned uden slutlinje - et roedt + // resultat saa ud som et nedbrud. Nu svarer et afslag som et DUMP med hjaelperens grund, ligesom trin 6. + let s5, tilbage = {}; + try { s5 = hj(['set-value', '--match-stdin', '--app', 'com.google.Chrome', '--role', 'AXTextArea'], + JSON.stringify({ contains: 'CMCPLIVEFELT', text: 'skrevet af proeven' })); } + catch (e) { try { s5 = JSON.parse(e.stdout || '{}'); } catch { s5 = { ok: false, error: String(e).slice(0, 120) }; } } + try { tilbage = hj(['find', '--app', 'com.google.Chrome', '--contains', 'CMCPLIVEFELT', '--role', 'AXTextArea', '--depth', '60']); } + catch (e) { try { tilbage = JSON.parse(e.stdout || '{}'); } catch { tilbage = {}; } } check('5. skrivning i tekstfeltet er verified og laest tilbage', s5.ok === true && s5.verified === true && JSON.stringify(tilbage.matches?.[0]?.names || []).includes('skrevet af proeven'), JSON.stringify(s5).slice(0, 160)); diff --git a/test/chrome-vault-live.mjs b/test/chrome-vault-live.mjs index 0fec5716..a0b92ed4 100644 --- a/test/chrome-vault-live.mjs +++ b/test/chrome-vault-live.mjs @@ -9,6 +9,7 @@ // 1. naar siden er bygget, svaertes HELE vinduet - af grunden «password manager page» // 2. find giver INTET fra siden (dens egne markoerer), og svaret siger at en adgangskode-side blev sprunget over // 3. inspect giver en «denied»-markering og intet af sidens indhold +// Y. naar proevens Chrome er lukket, er signalerne vaek - de kom fra den, ikke fra et andet vindue import { execFileSync } from 'node:child_process'; import { startChrome, inaktivSek, MIN_INAKTIV, slutDom } from './chrome-start.mjs'; import { existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs'; @@ -20,7 +21,7 @@ const START_MS = Date.now(); const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..'); const H = process.env.CMCP_HELPER || join(ROOT, 'mcp-server', 'vendor', 'cmcp-helper'); -const N = 5; +const N = 6; const spring = (grund) => { console.log(`SPRUNGET OVER: ${N} (${grund}) - bevist intet, ikke bestaaet`); process.exit(0); }; if (!existsSync('/Applications/Google Chrome.app')) spring('Google Chrome er ikke installeret her'); { @@ -40,11 +41,22 @@ const I = `INDHOLD${Math.random().toString(36).slice(2, 10).toUpperCase()}`; // ⛔ R6 (Astra, MAALT med syntetiske svar): grunden «password manager page», skipped_password_pages og denied gives // pr. PROGRAM, ikke pr. vindue - et ANDET Chrome-vindue med en adgangskode-side kunne give proeven dens groenne svar. // Derfor foerst: intet andet Chrome-vindue maa vise en adgangskode-side. Ellers beviser proeven intet. +// ⛔ R7 (Opus O3/O4 + Astra, MAALT 5/11): (a) «/password manager page/» ramte ogsaa ROLLE-grunden («...could not be ruled +// out as a password manager page»), saa forkontrollen sprang over paa en ulaeselig rolle i personens faner, og +// tjek 1-3 kunne bestaa paa den. Nu matches vault-grundens PRAECISE form. (b) Forkontrollen kan vaere ufuldstaendig +// (et vindue der foerst bliver laesbart senere). Derfor ogsaa en EFTERKONTROL, naar proevens Chrome er lukket: +// er signalerne der stadig, kom de ikke fra proeven, og saa er den roed (Y). +const VAULT_HEL = /\(a password manager page - window blacked out whole\)$/; // secure-rects' whole_window +const VAULT_SPRUNGET = /: a password manager page$/; // find's skipped_password_pages +const VAULT_NOEGLE = /^This is a password manager page\./; // inspect's denied-note +const vaultSignaler = () => { + const sr = hj(['secure-rects', '--app', 'com.google.Chrome']); + const ff = hj(['find', '--app', 'com.google.Chrome', '--contains', 'ZZZCMCPINGENTINGZZZ', '--depth', '60']); + return [...(sr.whole_window || []).filter((g) => VAULT_HEL.test(g)), ...(ff.skipped_password_pages || []).filter((g) => VAULT_SPRUNGET.test(g))]; +}; { - const foer = hj(['secure-rects', '--app', 'com.google.Chrome']); - const fremmed = (foer.whole_window || []).some((g) => /password manager page/.test(g)); - const ff = hj(['find', '--app', 'com.google.Chrome', '--contains', 'ZZZCMCPINGENTINGZZZ', '--depth', '30']); - if (fremmed || (ff.skipped_password_pages || []).length) spring('et andet Chrome-vindue viser allerede en adgangskode-side - proevens svar kunne komme derfra'); + const foer = vaultSignaler(); + if (foer.length) spring(`et andet Chrome-vindue viser allerede en adgangskode-side (${foer.length} signaler) - proevens svar kunne komme derfra`); } // Selvsigneret certifikat til vault.bitwarden.com - kun i en engangs-mappe. @@ -82,28 +94,36 @@ try { let sr = { rects: [], whole_window: [] }; for (let i = 0; i < 60; i++) { sr = hj(['secure-rects', '--app', 'com.google.Chrome']); - if ((sr.whole_window || []).some((g) => /password manager page/.test(g))) break; + if ((sr.whole_window || []).some((g) => VAULT_HEL.test(g))) break; await vent(500); } check('1. vinduet svaertes HELT, af grunden «password manager page»', - sr.rects.filter(iV).some(heleV) && (sr.whole_window || []).some((g) => /password manager page/.test(g)), + sr.rects.filter(iV).some(heleV) && (sr.whole_window || []).some((g) => VAULT_HEL.test(g)), `rekt ${JSON.stringify(sr.rects.filter(iV))} grunde ${JSON.stringify(sr.whole_window)}`); // 2. find: sidens EGNE markoerer findes ikke, og svaret siger hvorfor. const f = hj(['find', '--app', 'com.google.Chrome', '--contains', I, '--depth', '60', '--limit', '50']); const fraSiden = f.matches || []; check('2. find giver intet fra siden, og siger at en adgangskode-side blev sprunget over', - fraSiden.length === 0 && (f.skipped_password_pages || []).some((g) => /password manager page/.test(g)), + fraSiden.length === 0 && (f.skipped_password_pages || []).some((g) => VAULT_SPRUNGET.test(g)), `fra siden: ${JSON.stringify(fraSiden.map((m) => m.role))} sprunget: ${JSON.stringify(f.skipped_password_pages)}`); // 3. inspect: kun en «denied»-markering; intet med sidens markoer (vinduets titel er Chromes egen - den taeller ikke). const ins = hj(['inspect', '--app', 'com.google.Chrome', '--depth', '14', '--limit', '4000']).nodes || []; - const naegtet = ins.filter((n) => n.denied && /password manager page/.test(n.note || '')); + const naegtet = ins.filter((n) => n.denied && n.role === 'AXWebArea' && VAULT_NOEGLE.test(n.note || '')); const indhold = ins.filter((n) => !n.denied && JSON.stringify([n.title, n.value, n.desc]).includes(I)); check('3. inspect giver en «denied»-markering og intet af sidens indhold', naegtet.length > 0 && indhold.length === 0, `naegtet ${naegtet.length}, med sidens markoer: ${indhold.map((n) => n.role).join(', ')}`); } finally { - check('Z. proevens Chrome er lukket igen', chrome.stop(), 'den lever stadig'); + const lukket = chrome.stop(); + check('Z. proevens Chrome er lukket igen', lukket, 'den lever stadig'); + // Y. Efterkontrollen: med proevens Chrome lukket maa ingen vault-signaler vaere tilbage. Er de det, kom de fra + // et andet vindue, og tjek 1-3 kan have bestaaet paa det - saa beviser proeven intet, og den er roed. + if (lukket) { + let efter = []; + try { efter = vaultSignaler(); } catch (e) { efter = [`efterkontrollen fejlede: ${String(e).slice(0, 80)}`]; } + check('Y. signalerne forsvandt med proevens Chrome (de kom derfra, ikke fra et andet vindue)', efter.length === 0, JSON.stringify(efter)); + } else check('Y. efterkontrollen kunne ikke koeres (proevens Chrome lever)', false, 'Z fejlede'); ryd(); } process.exit(slutDom(fejl, N, START_MS)); diff --git a/test/claims-offline.mjs b/test/claims-offline.mjs index 8239b798..66657f86 100644 --- a/test/claims-offline.mjs +++ b/test/claims-offline.mjs @@ -217,6 +217,14 @@ check('kontakten kan slaas fra, saa tallet kan efterproeves udefra', check('vault-porten: den direkte indsaettelse spoerger ogsaa', /iVaultSide\(el\)/.test(ins), 'indsaetIFokus mangler iVaultSide'); check('vault-porten: koordinat-opslaget (at) og klik-porten kender adgangskode-sider', /password_page/.test(mainSw) && /appKlik\.password_page/.test(readFileSync(join(ROOT, 'mcp-server', 'index.js'), 'utf8')), 'at eller serveren mangler password_page'); + // R8: sende-dommen skelner en GENKENDT adgangskode-side fra en der ikke kunne afgoeres, paa `at`-notens ordlyd. Begge + // sider af kontrakten: hjaelperens note og vault-grundens tekst skal give praecis det praefiks, serveren leder efter. + const srvTekst = readFileSync(join(ROOT, 'mcp-server', 'index.js'), 'utf8'); + check('vault-porten: `at`-notens ordlyd er den, sende-dommen genkender (hjaelper og server i takt)', + mainSw.includes('"note": "The point is inside \\(g); nothing from it is returned."') + && /return erVaultAdresse\(u\) \? "a password manager page" : nil/.test(sw) + && srvTekst.includes("/^The point is inside a password manager page;/.test(String(d.note || ''))"), + 'notens skabelon, vault-grunden eller serverens moenster er aendret uden de andre'); } const LOEFTER = [ From ceb47d4a2fd1a86fbad87951b3506db60a0da8c7 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Thu, 5 Nov 2026 11:59:00 +0100 Subject: [PATCH 57/94] R9 (hjaelper): adgangskode-sider siges i press/set-value/wait-for, adressen normaliseres, nil-id er mulig browser, rollefejl siges som rollefejl - vaelgTraef: et tomt resultat siger hvor mange adgangskode-sider der blev sprunget over (skipped_password_pages) - Astra/Opus A6 - wait-for: tidsudloebet siger det samme - set-value paa fokus i en adgangskode-side: siger hvad den er, ikke 'a secure field' (samme kode) - Opus R5-O6 - set-value/press ufuldstaendig: rollefejl vs tidsudloeb skelnes (tidSlut) - Astra R7 - erVaultAdresse: punktum efter vaertsnavnet og dobbelte skraastreger i stien - Opus R7-O15 - find/inspect: program uden bundle-id regnes som mulig browser (som fokus-vejen) - Opus R7-O8 - proever: vault-adresse +7 (begge veje), chrome-vault-live 4-5, claims-offline (kode + binaer-loefte) - mutanter M10 (normalisering) og M11 (tomt resultat tier) i mutanter.py; M10 draebt offline (4 roede) - F1-resten (helt fravaerende hovedomraade) er IKKE med: kraever en maaling med et sidepanel/DevTools Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 9 +++++++ README.md | 6 +++-- docs/llms.txt | 3 ++- docs/security.html | 2 +- .../Sources/cmcp-helper/Accessibility.swift | 12 ++++++--- helper/Sources/cmcp-helper/main.swift | 26 ++++++++++++++++--- mcp-server/README.md | 6 +++-- test/chrome-vault-live.mjs | 15 ++++++++++- test/claims-offline.mjs | 11 ++++++++ test/vault-adresse.mjs | 4 +++ 10 files changed, 79 insertions(+), 15 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index dab6106b..c6f1717c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -83,6 +83,15 @@ pages), screen recordings, and a vault navigated away from in the instant betwee capture and scan. It is a guard against accidents, not a fence: non-text keys, developer tools and the clipboard are not covered. Test: `test/chrome-vault-live.mjs` against a real vault address (`https://vault.bitwarden.com`, served locally over HTTPS and pointed at with `--host-resolver-rules`; Chrome does not open its own password page from the command line). The signals are per app, not per window, so the test refuses to measure when another Chrome window already shows a password page, matches the vault reason's exact wording (not the "role could not be read" reason), and after closing its own Chrome checks that the signals went with it - if they did not, it is red. `test/chrome-dyb-side-live.mjs` binds its depth reason the same way. +After the third review (R7-R9, 5 Nov): `computer_press`, `computer_set_value` and +`computer_wait_for` say when they skipped a password manager page (`skipped_password_pages`) +instead of only "nothing matched", so an agent does not keep searching (`test/chrome-vault-live.mjs` +4-5); a write into a focus inside such a page says what it is rather than "a secure field"; a +host written with a final dot (`vault.bitwarden.com.`) and doubled slashes in the path are the +same page (`test/vault-adresse.mjs`); an app without a bundle id counts as a possible browser in +find and inspect, as it already did for the focus; and a write that stops because part of a +browser's tree could not be read says that, not that the search ran out of time. + **The screen without a question, if you want it.** Set `CMCP_SCREEN_ASK=0` and an agent that needs the screen borrows it with no question and no Touch ID - at once, or eight seconds after another agent's loan ends, so the one before has had time to stop diff --git a/README.md b/README.md index 75587516..d8e6b7b8 100644 --- a/README.md +++ b/README.md @@ -532,8 +532,10 @@ sit unnoticed until it expires. That is a real limitation today, not a setting. Bitwarden, LastPass, Dashlane, Proton Pass, Keeper, NordPass, RoboForm, Avira, Google Passwords) or one of eighteen known password-manager extensions in Chrome and Edge - also as a suggestion menu inside another page - is never returned by - `computer_find`, `computer_inspect`, `computer_focused` or the click gate, its - window is blacked out whole in screenshots, typing there is refused, and a click + `computer_find`, `computer_inspect`, `computer_focused` or the click gate + (`computer_press`, `computer_set_value` and `computer_wait_for` say when they + skipped one, instead of only "nothing matched"), its window is blacked out whole + in screenshots, typing there is refused, and a click there is refused (or, without an app named, which needs foreground mode, asks every time) - like password manager apps. The address rule applies to a web page in any app, not only in a browser. A web page whose address cannot be read (in any diff --git a/docs/llms.txt b/docs/llms.txt index 323c5b98..8f73253c 100644 --- a/docs/llms.txt +++ b/docs/llms.txt @@ -114,7 +114,8 @@ under a friendlier name. unnamed Chromium browsers are not covered. A login inside a cross-site iframe can be missing from the tree while it shows. Password managers inside a browser (the browser's own password page, known web vaults, eighteen known extensions - also as - a suggestion menu in another page) are never returned by find, inspect or focused, + a suggestion menu in another page) are never returned by find, inspect or focused + (press, set_value and wait_for say when they skipped one), their window is blacked out whole, typing there is refused, and a click there is refused or asks every time, like password manager apps. The address rule applies to a web page in any app; a page whose address, or a browser element whose role, cannot diff --git a/docs/security.html b/docs/security.html index 6c6daf18..e9cf0a07 100644 --- a/docs/security.html +++ b/docs/security.html @@ -199,7 +199,7 @@

Gate 1 - redaction happens before the file exists

Had we written the file first and redacted after, there would be a window - short, but real - where an unredacted picture of your desktop sat on disk for any other process to read. A security property with a race in it is not a security property.

Two things get painted:

    -
  • Secure text fields. Native fields expose the role AXSecureTextField. Fields in a web page expose the role AXTextField with the subrole AXSecureTextField. Checking only the role catches native fields and lets every browser password box through - which is the case that actually matters. We check both. A field in a web page is only visible once the browser shows its page to the accessibility layer: in Chrome this server switches that on (the switch a screen reader uses), and while a Chrome window's page is not readable yet - still being built, 3 to 15 seconds after it is first switched on, measured on Chrome 156, or empty - the whole window is painted over instead. Not covered: Safari, Firefox, Chromium browsers we do not name, Chrome app windows, and any browser when CMCP_INGEN_ELECTRON=1 is set. Known gaps, not measured: a field in a cross-site frame, or a login step that appears before Chrome has updated its tree. Password managers inside a browser are treated like native ones: a page whose address is the browser's own password page, a known web vault or one of eighteen known password-manager extensions in Chrome and Edge (also as a suggestion menu inside another page) is never returned by the reading tools, its window is blacked out whole, typing there is refused, and a click there is refused (or, without an app named, which needs foreground mode, asks every time) - like password manager apps. The address rule applies to a web page in any app, not only a browser; a page whose address, or a browser element whose role, cannot be read is kept out of the reading tools too, and a search then says it was incomplete. Not recognised: a self-hosted vault, an unlisted extension, Safari's and Firefox's extension pages. Not hidden: window and menu titles (as for native apps), screen recordings, and Chrome's own password bubbles and autofill rows, which are native panels rather than pages. It is a guard against accidents, not a fence: keys that are not text, developer tools and the clipboard are not covered.
    • +
  • Secure text fields. Native fields expose the role AXSecureTextField. Fields in a web page expose the role AXTextField with the subrole AXSecureTextField. Checking only the role catches native fields and lets every browser password box through - which is the case that actually matters. We check both. A field in a web page is only visible once the browser shows its page to the accessibility layer: in Chrome this server switches that on (the switch a screen reader uses), and while a Chrome window's page is not readable yet - still being built, 3 to 15 seconds after it is first switched on, measured on Chrome 156, or empty - the whole window is painted over instead. Not covered: Safari, Firefox, Chromium browsers we do not name, Chrome app windows, and any browser when CMCP_INGEN_ELECTRON=1 is set. Known gaps, not measured: a field in a cross-site frame, or a login step that appears before Chrome has updated its tree. Password managers inside a browser are treated like native ones: a page whose address is the browser's own password page, a known web vault or one of eighteen known password-manager extensions in Chrome and Edge (also as a suggestion menu inside another page) is never returned by the reading tools (and the acting tools say when they skipped one), its window is blacked out whole, typing there is refused, and a click there is refused (or, without an app named, which needs foreground mode, asks every time) - like password manager apps. The address rule applies to a web page in any app, not only a browser; a page whose address, or a browser element whose role, cannot be read is kept out of the reading tools too, and a search then says it was incomplete. Not recognised: a self-hosted vault, an unlisted extension, Safari's and Firefox's extension pages. Not hidden: window and menu titles (as for native apps), screen recordings, and Chrome's own password bubbles and autofill rows, which are native panels rather than pages. It is a guard against accidents, not a fence: keys that are not text, developer tools and the clipboard are not covered.
  • Whole windows of listed apps. Keychain Access, 1Password, Bitwarden, LastPass, Dashlane, Apple Passwords. We do not walk into those windows to decide what to hide; descending into a vault to work out what is secret is the mistake we are avoiding.

The rectangles are painted solid black, not blurred or pixelated. A good enough model can read through pixelation. It cannot read through black.

diff --git a/helper/Sources/cmcp-helper/Accessibility.swift b/helper/Sources/cmcp-helper/Accessibility.swift index 8b4271ff..29f2ea71 100644 --- a/helper/Sources/cmcp-helper/Accessibility.swift +++ b/helper/Sources/cmcp-helper/Accessibility.swift @@ -771,8 +771,10 @@ enum AX { let efter = rest.dropFirst(32).first return vaultUdvidelser.contains(String(rest.prefix(32))) && (efter == nil || "/?#".contains(efter!)) } - guard let u = URL(string: url), let vaert = u.host?.lowercased() else { return false } - let sti = u.path.lowercased() + guard let u = URL(string: url), var vaert = u.host?.lowercased() else { return false } + // R9 (Opus R7-O15): «vault.bitwarden.com.» (fuldt navn med punktum) og «lastpass.com//vault/» er samme sider. + while vaert.hasSuffix(".") { vaert.removeLast() } + let sti = u.path.lowercased().replacingOccurrences(of: "/{2,}", with: "/", options: .regularExpression) // Googles offentlige velkomstside er ikke et hvaelv (R4, Astra). let paaSti = { (p: String) in sti == p || sti.hasPrefix(p + "/") } // R6 (Astra): «/intro-private», «/vaulting» er ikke stien if vaert == "passwords.google.com", paaSti("/intro") { return false } @@ -1160,7 +1162,8 @@ enum AX { ]) continue } - let erBrowserApp = erBrowser(app.bundleIdentifier) + // R9 (Opus R7-O8): et program uden bundle-id kan ikke udelukkes som browser - samme regel som fokus-vejen (iVaultSide). + let erBrowserApp = app.bundleIdentifier == nil || erBrowser(app.bundleIdentifier) AX.taendTrae(app.processIdentifier) let axApp = AXUIElementCreateApplication(app.processIdentifier) var wins = (attr(axApp, kAXWindowsAttribute as String) as? [AXUIElement]) ?? [] @@ -1288,7 +1291,8 @@ extension AX { // traeffere. En soegning der kan finde "brugernavn" i 1Password er // den samme laek, bare med et filter paa. if erSpaerret(app, ekstraDeny) { continue } - let erBrowserApp = erBrowser(app.bundleIdentifier) + // R9 (Opus R7-O8): et program uden bundle-id kan ikke udelukkes som browser - samme regel som fokus-vejen (iVaultSide). + let erBrowserApp = app.bundleIdentifier == nil || erBrowser(app.bundleIdentifier) AX.taendTrae(app.processIdentifier) let axApp = AXUIElementCreateApplication(app.processIdentifier) var wins = (attr(axApp, kAXWindowsAttribute as String) as? [AXUIElement]) ?? [] diff --git a/helper/Sources/cmcp-helper/main.swift b/helper/Sources/cmcp-helper/main.swift index 57dfcc28..4b2c87f2 100644 --- a/helper/Sources/cmcp-helper/main.swift +++ b/helper/Sources/cmcp-helper/main.swift @@ -83,12 +83,21 @@ func vaelgTraef(_ hits: [AX.Match], _ args: Args, maaGaette: Bool) -> AX.Match { case .vaelg(let i): return hits[i] case .ufuldstaendig: - Out.fail("the search stopped after \(Int(AX.tidsgraense)) seconds before it had seen the whole app, so another matching element cannot be ruled out - nothing was done. Narrow the search (role, subrole, title or a lower depth), or pick one with index from computer_find.", + // R7 (Astra): «stopped after N seconds» var forkert, naar grenen blev sprunget pga. en ulaeselig rolle - samme skel som find/inspect. + let hvorfor = AX.tidSlut + ? "the search stopped after \(Int(AX.tidsgraense)) seconds before it had seen the whole app" + : "part of this browser's tree could not be read (a role lookup failed), so the search did not see the whole app" + Out.fail("\(hvorfor), so another matching element cannot be ruled out - nothing was done. Narrow the search (role, subrole, title or a lower depth), or pick one with index from computer_find.", code: "search-incomplete", extra: ["matches": hits.map(\.dict), "count": hits.count, "stopped_early": true]) case .udenforListen: Out.fail("there is no match number \(args.int("index") ?? -1); there are \(hits.count)", code: "not-found", extra: ["matches": hits.map(\.dict), "count": hits.count]) case .ingen: + // R9 (Astra/Opus A6): var en adgangskode-side sprunget over, siges det - ellers leder agenten videre i ring. + if !AX.vaultSprunget.isEmpty { + Out.fail("nothing matched - \(Set(AX.vaultSprunget).count) password manager page(s) were not searched; like password manager apps, an agent does not act there. Ask the person with computer_ask_user.", + code: "not-found", extra: ["count": 0, "skipped_password_pages": Array(Set(AX.vaultSprunget)).sorted()]) + } Out.fail("nothing matched", code: "not-found", extra: ["count": 0]) case .tvetydigOverskriver: Out.fail("found \(hits.count) matches, and this action overwrites text, so it does not guess - pick one with index (its number in matches) or narrow with subrole", @@ -589,7 +598,13 @@ case "set-value": let role = (t.dict["role"] as? String) ?? "" // R24 (Astra): paa FOKUS-vejen kan macOS' adgangskodesignal se et felt AX ikke kan. // Vault-porten (5/11): paa fokus-vejen kan feltet ligge i en adgangskode-side; find springer dem over, fokus goer ikke. - if AX.isSecure(t.el, role: role) || (fokusVej && AX.iVaultSide(t.el) != nil) + // R9 (Opus R5-O6): fokus i en adgangskode-side - eller en side der ikke kunne afgoeres - er ikke «a secure field». + // Svaret siger hvad det er; koden er den samme, saa serverens behandling er uaendret. + if fokusVej, let g = AX.iVaultSide(t.el) { + Out.fail("the keyboard focus is inside \(g) - like a password manager app, an agent never writes there. Ask the person to type it themselves with computer_ask_user.", + code: "secure-field", extra: ["element": t.dict]) + } + if AX.isSecure(t.el, role: role) || (fokusVej && skriveDom(fokusSikkert: false, sikkerIndtastning: macosSikkerIndtastning()) == .sikkertFelt) { Out.fail("this is a secure field - we do not write into password fields. Ask the person to type it themselves with computer_ask_user.", code: "secure-field", extra: ["element": t.dict]) @@ -891,9 +906,12 @@ case "wait-for": } // En timeout er et svar, ikke en fejl i opsaetningen. Beskeden siger hvad // der blev ledt efter, saa agenten kan indsnaevre i stedet for at gentage. - Out.fail("no element appeared within the time limit", + // R9 (A6): et element inde i en adgangskode-side dukker aldrig op her - sig det, saa agenten ikke venter igen. + let ventVault = Array(Set(AX.vaultSprunget)).sorted() + Out.fail(ventVault.isEmpty ? "no element appeared within the time limit" + : "no element appeared within the time limit - \(ventVault.count) password manager page(s) were not searched; their content is never returned", code: "wait-timeout", - extra: ["found": false, "attempts": attempts, + extra: ["found": false, "attempts": attempts, "skipped_password_pages": ventVault, "soegte": ["app": args.str("app") ?? "alle", "role": args.str("role") ?? "-", "title": _soeg.title ?? "-", diff --git a/mcp-server/README.md b/mcp-server/README.md index dff3b415..98c22bb3 100644 --- a/mcp-server/README.md +++ b/mcp-server/README.md @@ -530,8 +530,10 @@ sit unnoticed until it expires. That is a real limitation today, not a setting. Bitwarden, LastPass, Dashlane, Proton Pass, Keeper, NordPass, RoboForm, Avira, Google Passwords) or one of eighteen known password-manager extensions in Chrome and Edge - also as a suggestion menu inside another page - is never returned by - `computer_find`, `computer_inspect`, `computer_focused` or the click gate, its - window is blacked out whole in screenshots, typing there is refused, and a click + `computer_find`, `computer_inspect`, `computer_focused` or the click gate + (`computer_press`, `computer_set_value` and `computer_wait_for` say when they + skipped one, instead of only "nothing matched"), its window is blacked out whole + in screenshots, typing there is refused, and a click there is refused (or, without an app named, which needs foreground mode, asks every time) - like password manager apps. The address rule applies to a web page in any app, not only in a browser. A web page whose address cannot be read (in any diff --git a/test/chrome-vault-live.mjs b/test/chrome-vault-live.mjs index a0b92ed4..b3e5d7c2 100644 --- a/test/chrome-vault-live.mjs +++ b/test/chrome-vault-live.mjs @@ -9,6 +9,7 @@ // 1. naar siden er bygget, svaertes HELE vinduet - af grunden «password manager page» // 2. find giver INTET fra siden (dens egne markoerer), og svaret siger at en adgangskode-side blev sprunget over // 3. inspect giver en «denied»-markering og intet af sidens indhold +// 4. press og 5. wait-for paa sidens markoer: intet fundet, og svaret siger at en adgangskode-side blev sprunget over // Y. naar proevens Chrome er lukket, er signalerne vaek - de kom fra den, ikke fra et andet vindue import { execFileSync } from 'node:child_process'; import { startChrome, inaktivSek, MIN_INAKTIV, slutDom } from './chrome-start.mjs'; @@ -21,7 +22,7 @@ const START_MS = Date.now(); const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..'); const H = process.env.CMCP_HELPER || join(ROOT, 'mcp-server', 'vendor', 'cmcp-helper'); -const N = 6; +const N = 8; const spring = (grund) => { console.log(`SPRUNGET OVER: ${N} (${grund}) - bevist intet, ikke bestaaet`); process.exit(0); }; if (!existsSync('/Applications/Google Chrome.app')) spring('Google Chrome er ikke installeret her'); { @@ -114,6 +115,18 @@ try { const indhold = ins.filter((n) => !n.denied && JSON.stringify([n.title, n.value, n.desc]).includes(I)); check('3. inspect giver en «denied»-markering og intet af sidens indhold', naegtet.length > 0 && indhold.length === 0, `naegtet ${naegtet.length}, med sidens markoer: ${indhold.map((n) => n.role).join(', ')}`); + + // 4-5. R9 (A6): et tryk og en ventetid paa sidens egne markoerer finder intet - og SIGER at en adgangskode-side blev sprunget + // over, saa agenten ikke leder videre i ring. (Hjaelperen svarer exit 1 paa et afslag; svaret laeses fra stdout.) + const afslag = (args) => { try { return hj(args); } catch (e) { try { return JSON.parse(e.stdout || '{}'); } catch { return {}; } } }; + const p4 = afslag(['press', '--app', 'com.google.Chrome', '--contains', `${I}-TEKST`, '--depth', '60', '--dry']); + check('4. press paa sidens tekst: intet fundet, og svaret siger at en adgangskode-side blev sprunget over', + p4.ok === false && p4.code === 'not-found' && (p4.skipped_password_pages || []).some((g) => VAULT_SPRUNGET.test(g)), + JSON.stringify(p4).slice(0, 200)); + const w5 = afslag(['wait-for', '--app', 'com.google.Chrome', '--contains', `${I}-TEKST`, '--depth', '60', '--timeout', '2']); + check('5. wait-for paa sidens tekst: tidsudloeb, og svaret siger at en adgangskode-side ikke blev gennemsoegt', + w5.ok === false && w5.code === 'wait-timeout' && (w5.skipped_password_pages || []).some((g) => VAULT_SPRUNGET.test(g)), + JSON.stringify(w5).slice(0, 200)); } finally { const lukket = chrome.stop(); check('Z. proevens Chrome er lukket igen', lukket, 'den lever stadig'); diff --git a/test/claims-offline.mjs b/test/claims-offline.mjs index 66657f86..43867d86 100644 --- a/test/claims-offline.mjs +++ b/test/claims-offline.mjs @@ -225,9 +225,20 @@ check('kontakten kan slaas fra, saa tallet kan efterproeves udefra', && /return erVaultAdresse\(u\) \? "a password manager page" : nil/.test(sw) && srvTekst.includes("/^The point is inside a password manager page;/.test(String(d.note || ''))"), 'notens skabelon, vault-grunden eller serverens moenster er aendret uden de andre'); + // R9: et program uden bundle-id kan ikke udelukkes som browser - i find OG inspect, som i fokus-vejen. + check('vault-porten: program uden bundle-id regnes som mulig browser i find og inspect', + (sw.match(/let erBrowserApp = app\.bundleIdentifier == nil \|\| erBrowser\(app\.bundleIdentifier\)/g) || []).length === 2, + 'find eller inspect regner nil-id for ikke-browser'); + check('vault-porten: fokus i en adgangskode-side kaldes ikke et «secure field» (set-value siger hvad det er)', + /if fokusVej, let g = AX\.iVaultSide\(t\.el\) \{\s*Out\.fail\("the keyboard focus is inside/.test(mainSw), 'set-value bruger stadig secure-field-teksten'); + check('vault-porten: wait-for og et tomt soegeresultat siger, at adgangskode-sider ikke blev gennemsoegt', + /password manager page\(s\) were not searched; their content is never returned/.test(mainSw) + && /password manager page\(s\) were not searched; like password manager apps/.test(mainSw), 'wait-for eller not-found tier om sprungne sider'); } const LOEFTER = [ + // R9 (A6): en binaer uden beskeden om sprungne adgangskode-sider kan ikke bestaa. + ['were not searched; their content is never returned', 'wait-for siger naar en adgangskode-side ikke blev gennemsoegt'], ['AXManualAccessibility', 'virker inde i Electron-programmer'], ['AXSecureTextField', 'kodeordsfelter kan findes og sloeres'], ['AXMenu', 'menuer kan laeses'], diff --git a/test/vault-adresse.mjs b/test/vault-adresse.mjs index 91b31b58..15416b4f 100644 --- a/test/vault-adresse.mjs +++ b/test/vault-adresse.mjs @@ -28,6 +28,8 @@ const ER = [ 'https://govcloud.keepersecurity.us/vault/', 'https://lastpass.com/vault/', 'https://www.lastpass.com/vault/', 'https://lastpass.eu/vault/', 'https://keepersecurity.com/vault/', 'https://keepersecurity.eu/vault/', 'https://keepersecurity.com.au/vault/', 'https://keepersecurity.ca/vault/', 'https://keepersecurity.jp/vault/', + // R9 (Opus R7-O15): fuldt vaertsnavn med punktum til sidst og dobbelte skraastreger er samme side + 'https://vault.bitwarden.com./', 'https://passwords.google.com./', 'https://lastpass.com//vault/', 'https://keepersecurity.com///vault', // udvidelser (Chrome Web Store + Edge Add-ons, hver bekraeftet 5/11) ...['aeblfdkhhhdcdjpifhhbdiojplfjncoa', 'nngceckbapebfimnlniiiahkandclblb', 'hdokiejnpimakedhajhdlcegeplioahd', 'fdjamakpfbbddfjaooikfcpapjohcfmg', 'ghmbeldphafepmbegfdlkpapadhbakde', 'bfogiafebfohielmmehodmfbbebbbpei', @@ -47,6 +49,8 @@ const ER_IKKE = [ // R6 (Astra): graenser efter id og sti 'extension://nngceckbapebfimnlniiiahkandclblb.example/popup.html', 'https://keepersecurity.com/vaulting', 'https://lastpass.com/vaultx/', + // R9: normaliseringen udvider ikke reglen - velkomstsiden og en anden sti er stadig ikke hvaelvet + 'https://passwords.google.com./intro', 'https://lastpass.com//vaulting', 'https://bitwarden.com./', ]; for (const u of ER) { if (sp(u) === true) ok++; else { fejl++; console.log(`DUMP genkendes ikke: ${u}`); } } for (const u of ER_IKKE) { if (sp(u) === false) ok++; else { fejl++; console.log(`DUMP genkendes forkert: ${u}`); } } From 49f221ed4c1ed7e8ff2fdaf556d860f9ea447a87 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Thu, 5 Nov 2026 12:14:02 +0100 Subject: [PATCH 58/94] R9b efter R8 (Astra IKKE GODKENDT): vault-klik uden app kraever altid et ja, grundene baerer procesnummeret, proeverne binder til egen Chrome MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - sende-dommen giver et maerke for en genkendt vault-side i stedet for null: alwaysAsk, aldrig via menulinjen, genkontrollen kraever samme maerke - Astras fem opslag (vault, vault, OK, vault, vault) klikkede uden spoergsmaal (bundet-maal 12f-12h; mutant med null tilbage: 12f+12g roede) - hjaelperen: hver grund siger « [pid N]», inspects vault-knude har pid; en ulaeselig adresse goer find/inspect ufuldstaendige som en ulaeselig rolle; teksterne navngiver begge aarsager - chrome-vault-live og chrome-dyb-side-live: hvert signal skal baere proeve-Chromens pid (for-/efterkontrol fjernet) - chrome-start stop(): kun pgrep-status 1 betyder lukket - CHANGELOG og serverinstruktionen (fanegruppen maalt een gang i haanden) Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 10 ++-- .../Sources/cmcp-helper/Accessibility.swift | 30 +++++++---- helper/Sources/cmcp-helper/main.swift | 6 +-- mcp-server/index.js | 18 +++++-- test/bundet-maal.mjs | 25 +++++++++ test/chrome-dyb-side-live.mjs | 29 ++++------ test/chrome-start.mjs | 3 +- test/chrome-vault-live.mjs | 53 +++++++------------ test/claims-offline.mjs | 9 ++++ 9 files changed, 108 insertions(+), 75 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c6f1717c..6b52dd05 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -59,7 +59,10 @@ click gate's lookup (the answer says what was left out), its window is blacked o in screenshots, typing (also the direct accessibility route) is refused, and a click is refused (without an app named, which needs foreground mode, it asks every time - the send gate no longer mistakes such a page, with its empty title, for a chat: `test/bundet-maal.mjs` -12d; a page that could not be checked might be a web chat, and keeps the send gate: 12e). A web page whose address cannot be read - in any app, since the address rule applies +12d; a page that could not be checked might be a web chat, and keeps the send gate: 12e). The send gate's own +lookup marks the page, so a second lookup that happens to see an ordinary button cannot turn the click into one +that is not asked (12f-12h, the review's five-lookup sequence; mutation-proven), and the yes cannot come from the +menu bar, as for password manager apps. A web page whose address cannot be read - in any app, since the address rule applies to web areas everywhere - or an element whose role cannot be read in a browser counts as one that cannot be ruled out. `version` lists `browser-password-pages`; `vault-url --url` answers the address rule on its @@ -81,7 +84,7 @@ unlisted extensions, Safari's and Firefox's extension pages, window and menu tit for native apps), Chrome's own password bubbles and autofill rows (native panels, not pages), screen recordings, and a vault navigated away from in the instant between capture and scan. It is a guard against accidents, not a fence: non-text keys, -developer tools and the clipboard are not covered. Test: `test/chrome-vault-live.mjs` against a real vault address (`https://vault.bitwarden.com`, served locally over HTTPS and pointed at with `--host-resolver-rules`; Chrome does not open its own password page from the command line). The signals are per app, not per window, so the test refuses to measure when another Chrome window already shows a password page, matches the vault reason's exact wording (not the "role could not be read" reason), and after closing its own Chrome checks that the signals went with it - if they did not, it is red. `test/chrome-dyb-side-live.mjs` binds its depth reason the same way. +developer tools and the clipboard are not covered. Test: `test/chrome-vault-live.mjs` against a real vault address (`https://vault.bitwarden.com`, served locally over HTTPS and pointed at with `--host-resolver-rules`; Chrome does not open its own password page from the command line). Every reason now carries the process it came from (`Google Chrome [pid 4321] (...)`, and `pid` on inspect's denied node), because two Chrome processes share one name: the test requires each signal to come from its own Chrome process and matches the vault reason's exact wording (not the "role could not be read" reason); a check before and after, which an unreadable window elsewhere could fool, was dropped. `test/chrome-dyb-side-live.mjs` binds its depth reason the same way. After the third review (R7-R9, 5 Nov): `computer_press`, `computer_set_value` and `computer_wait_for` say when they skipped a password manager page (`skipped_password_pages`) @@ -89,7 +92,8 @@ instead of only "nothing matched", so an agent does not keep searching (`test/ch 4-5); a write into a focus inside such a page says what it is rather than "a secure field"; a host written with a final dot (`vault.bitwarden.com.`) and doubled slashes in the path are the same page (`test/vault-adresse.mjs`); an app without a bundle id counts as a possible browser in -find and inspect, as it already did for the focus; and a write that stops because part of a +find and inspect, as it already did for the focus; a page whose address cannot be read marks the +search incomplete, as an unreadable role does, so a write never picks the one match left; and a write that stops because part of a browser's tree could not be read says that, not that the search ran out of time. **The screen without a question, if you want it.** Set `CMCP_SCREEN_ASK=0` and an diff --git a/helper/Sources/cmcp-helper/Accessibility.swift b/helper/Sources/cmcp-helper/Accessibility.swift index 29f2ea71..3aaf3006 100644 --- a/helper/Sources/cmcp-helper/Accessibility.swift +++ b/helper/Sources/cmcp-helper/Accessibility.swift @@ -845,6 +845,11 @@ enum AX { /// Grunden naar adressen ikke kunne laeses: holdes ude af laesningen; i skaermbilledet svaertes OMRAADET, ikke hele vinduet. static let vaultUkendtGrund = "a page whose address could not be read, so it could not be ruled out as a password manager" /// R6 (Astra): en ulaeselig ROLLE i en browser har sin egen grund - ikke «adressen». + /// R9 (Astra R8-4): grundene gives pr. PROGRAM, og to Chrome-processer hedder begge «Google Chrome». Procesnummeret + /// binder en grund til sin proces - saa en proeve (og en agent) kan se, HVILKEN Chrome den kom fra. + static func etiket(_ app: NSRunningApplication, _ bid: String) -> String { + "\(app.localizedName ?? bid) [pid \(app.processIdentifier)]" + } static let vaultRolleGrund = "a browser element whose role could not be read, so it could not be ruled out as a password manager page" /// Find alle rektangler der skal sloeres. Dybden er bevidst begraenset: @@ -945,7 +950,7 @@ enum AX { // faldbag som de to andre steder: kender vi ikke rammerne, svaertes // hele omraadet. Rettelsen kom paa to af tre steder foerste gang. out.append(contentsOf: cg.isEmpty ? [indenfor ?? heleSkaermen()] : cg) - sloeringStoppede.append((app.localizedName ?? bid) + " (did not answer - its windows were blacked out whole)") + sloeringStoppede.append(etiket(app, bid) + " (did not answer - its windows were blacked out whole)") continue } var wins = opslag.vinduer @@ -984,7 +989,7 @@ enum AX { let hele = frame(win).map { [$0] } ?? cgRammer(pid: app.processIdentifier) out.append(contentsOf: hele.isEmpty ? [indenfor ?? heleSkaermen()] : hele) // R2 (Astra): noten sagde «ran out of time» om ALLE grunde - nu baerer hver post sin egen. - sloeringStoppede.append((app.localizedName ?? bid) + " (the scan ran out of time)") + sloeringStoppede.append(etiket(app, bid) + " (the scan ran out of time)") continue } // ⛔ MAALT 4/11: Chrome har ogsaa titelloese hjaelpe-vinduer (fanelinje og @@ -1022,7 +1027,7 @@ enum AX { let hele = frame(win).map { [$0] } ?? cgRammer(pid: app.processIdentifier) out.append(contentsOf: hele.isEmpty ? [indenfor ?? heleSkaermen()] : hele) if !chromeNoteSat { - sloeringStoppede.append((app.localizedName ?? bid) + " (its page could not be checked - still being built, empty, not fully readable, or a browser panel that never has a page - so the window was blacked out whole)") + sloeringStoppede.append(etiket(app, bid) + " (its page could not be checked - still being built, empty, not fully readable, or a browser panel that never has a page - so the window was blacked out whole)") chromeNoteSat = true } continue @@ -1065,7 +1070,7 @@ enum AX { if let g = vaultHer { let hele = frame(win).map { [$0] } ?? cgRammer(pid: app.processIdentifier) out.append(contentsOf: hele.isEmpty ? [indenfor ?? heleSkaermen()] : hele) - sloeringStoppede.append((app.localizedName ?? bid) + " (\(g) - window blacked out whole)") + sloeringStoppede.append(etiket(app, bid) + " (\(g) - window blacked out whole)") continue } // ⛔ REVIEW 5/11 (Opus, F5) - og MAALT: et kodefelt under 45 indlejrede grupper laa dybere end @@ -1075,13 +1080,13 @@ enum AX { if erChromium && !gennemgangOverskred && (dybdeRamt || uvisseOpslag > uvisseFoer) { let hele = frame(win).map { [$0] } ?? cgRammer(pid: app.processIdentifier) out.append(contentsOf: hele.isEmpty ? [indenfor ?? heleSkaermen()] : hele) - sloeringStoppede.append((app.localizedName ?? bid) + (dybdeRamt ? " (its page went deeper than the scan reaches - window blacked out whole)" : " (a lookup in its page failed or timed out - window blacked out whole)")) + sloeringStoppede.append(etiket(app, bid) + (dybdeRamt ? " (its page went deeper than the scan reaches - window blacked out whole)" : " (a lookup in its page failed or timed out - window blacked out whole)")) continue } if gennemgangOverskred { let hele = frame(win).map { [$0] } ?? cgRammer(pid: app.processIdentifier) out.append(contentsOf: hele.isEmpty ? [indenfor ?? heleSkaermen()] : hele) - sloeringStoppede.append((app.localizedName ?? bid) + " (walk ran out of time - window blacked out whole)") + sloeringStoppede.append(etiket(app, bid) + " (walk ran out of time - window blacked out whole)") } } } @@ -1201,9 +1206,10 @@ enum AX { } // Vault-porten (5/11): kun AT der er en adgangskode-side - aldrig hvad der staar paa den. if let g = vaultGrund(el, rolle: role) { - nodes.append(["app": app.localizedName ?? "", "bundleId": app.bundleIdentifier ?? "", + nodes.append(["app": app.localizedName ?? "", "bundleId": app.bundleIdentifier ?? "", "pid": Int(app.processIdentifier), "role": role, "depth": d, "denied": true, "note": "This is \(g). Like a password manager app, its content is not returned, and screenshots black it out."]) + if g == vaultUkendtGrund { stoppedeTidligt = true } // R9: som i find continue } let isSecure = isSecure(el, role: role) @@ -1333,10 +1339,16 @@ extension AX { // R6 (Astra): en sprunget gren kan rumme et felt med samme navn - saa er svaret ikke fuldstaendigt, // og en skrivning maa ikke vaelge «det eneste» fund (Skrivevagt ser stoppedeTidligt). stoppedeTidligt = true - vaultSprunget.append("\(app.localizedName ?? ""): \(vaultRolleGrund)"); continue + vaultSprunget.append("\(etiket(app, app.bundleIdentifier ?? "")): \(vaultRolleGrund)"); continue } // Vault-porten (5/11): intet fra en adgangskode-side - hverken den eller noget under den. - if let g = vaultGrund(el, rolle: r) { vaultSprunget.append("\(app.localizedName ?? ""): \(g)"); continue } + if let g = vaultGrund(el, rolle: r) { + vaultSprunget.append("\(etiket(app, app.bundleIdentifier ?? "")): \(g)") + // R9 (Astra R8-5): en side hvis adresse ikke kunne laeses, er ikke udelukket - svaret er ufuldstaendigt, + // saa en skrivning aldrig vaelger det ene traef der er tilbage (samme regel som rollevejen). + if g == vaultUkendtGrund { stoppedeTidligt = true } + continue + } for c in children(el).reversed() { stack.append((c, d + 1)) } if let wr = wantRole, r.lowercased() != wr, "ax" + wr != r.lowercased() { continue } diff --git a/helper/Sources/cmcp-helper/main.swift b/helper/Sources/cmcp-helper/main.swift index 4b2c87f2..7af2a014 100644 --- a/helper/Sources/cmcp-helper/main.swift +++ b/helper/Sources/cmcp-helper/main.swift @@ -86,7 +86,7 @@ func vaelgTraef(_ hits: [AX.Match], _ args: Args, maaGaette: Bool) -> AX.Match { // R7 (Astra): «stopped after N seconds» var forkert, naar grenen blev sprunget pga. en ulaeselig rolle - samme skel som find/inspect. let hvorfor = AX.tidSlut ? "the search stopped after \(Int(AX.tidsgraense)) seconds before it had seen the whole app" - : "part of this browser's tree could not be read (a role lookup failed), so the search did not see the whole app" + : "part of this browser's tree could not be read (a role lookup failed, or a page's address could not be read to rule out a password manager), so the search did not see the whole app" Out.fail("\(hvorfor), so another matching element cannot be ruled out - nothing was done. Narrow the search (role, subrole, title or a lower depth), or pick one with index from computer_find.", code: "search-incomplete", extra: ["matches": hits.map(\.dict), "count": hits.count, "stopped_early": true]) case .udenforListen: @@ -499,7 +499,7 @@ case "inspect": svar["stopped_early"] = true svar["note"] = AX.tidSlut ? "The walk stopped after \(Int(AX.tidsgraense)) seconds - this app answers slowly, so this is PART of the tree, not all of it. Narrow it with find, or a lower depth." - : "Part of this browser's tree could not be read (a role lookup failed), so it was left out; this is PART of the tree, not all of it." + : "Part of this browser's tree could not be read (a role lookup failed, or a page's address could not be read to rule out a password manager), so it was left out; this is PART of the tree, not all of it." } // R2 (Opus N7): inspect havde intet signal for en Chrome-side der stadig bygges - samme som find. if AX.chromeTaendtNu || AX.chromeSideUlaeselig(scope: args.str("app")) { @@ -532,7 +532,7 @@ case "find": fundSvar["stopped_early"] = true fundSvar["note"] = [fundSvar["note"] as? String, AX.tidSlut ? "The search stopped after \(Int(AX.tidsgraense)) seconds - this app answers slowly, so these are the matches in PART of it, not all. Narrow it with role, subrole, title or a lower depth." - : "Part of this browser's tree could not be read (a role lookup failed) and was left out, so these are not all matches; a write will not pick one on its own."].compactMap { $0 }.joined(separator: " ") + : "Part of this browser's tree could not be read (a role lookup failed, or a page's address could not be read to rule out a password manager) and was left out, so these are not all matches; a write will not pick one on its own."].compactMap { $0 }.joined(separator: " ") } // ⛔ MAALT 4/11: kaldet der taendte Chromes web-trae, saa 0 - traeet kom 3-15 s senere. if hits.isEmpty && (AX.chromeTaendtNu || AX.chromeSideUlaeselig(scope: args.str("app"))) { diff --git a/mcp-server/index.js b/mcp-server/index.js index 8196247c..62ad2ace 100644 --- a/mcp-server/index.js +++ b/mcp-server/index.js @@ -282,8 +282,9 @@ the work inside pages, and take over where it is refused: Chrome blocks EVERY extension on Chrome Web Store and its developer console ("The extensions gallery cannot be scripted"). The browser tool can still navigate there and list its tabs. Find that window by its tab group: the window title contains the group's -name, in Chrome's own interface language, and browser_list_tabs reports it as -"session". That name is the link between the two tools. +name, in Chrome's own interface language (measured once by hand; if it is not +there, list the windows), and browser_list_tabs reports it as "session". That +name is the link between the two tools. Everything is written to an append-only audit log with a rolling chain.`; @@ -730,7 +731,11 @@ async function sendeDom(name, args, bid, appKlik = null) { // vindue (hjaelperen udleverer intet derfra), og blev her doemt som en chat - et haardt Send-afslag uden mening. Siden // er ingen besked; knapErFarlig doemmer den farlig, saa personen spoerges, som ved et adgangskode-program. En side // der ikke kunne afgoeres (12e), doemmes stadig her, fejl-lukket. - if (k?.adgangskodeSide) return null; + // ⛔ R8 (Astra, MAALT med fem opslag): `null` her gjorde klikket til et almindeligt klik, og knapErFarlig slaar + // punktet op IGEN. Svarede det andet opslag «en OK-knap», blev der klikket i en vault uden spoergsmaal. Nu er + // svaret et maerke: det tvinger et ja (alwaysAsk, aldrig via menulinjen - som et adgangskode-program), og + // genkontrollen under laasen kraever samme maerke (12f-12g). + if (k?.adgangskodeSide) return { adgangskodeSide: true }; // Runde 5 (Astra 2, Fable 1): en kontrol hvis vindue ikke kan laeses, er et ukendt // vindue - det doemmes som den fokuserede titel doemmes: fejl-lukket, som en chat. const titler = [String(t.window || '').trim(), ...(k ? [k.fejl ? '' : String(k.vindue || '').trim()] : [])]; @@ -2066,7 +2071,7 @@ async function haandterKald(request) { // («Type 11 characters»). Status og koe beholder den korte tekst. tier: effektivTier, targetBundleId, describe: sende?.describe || describe(name, args), ikon: { session: SESSION, client: server.getClientVersion?.()?.name || process.env.CMCP_CLIENT || null }, - aldrigViaIkonet: usloeretBillede, + aldrigViaIkonet: usloeretBillede || sende?.adgangskodeSide === true, // Et menupunkt der ser ud til at slette noget, spoerger hver gang - // ogsaa i allow, som et farligt program. // At lukke et vindue kan tabe ugemt arbejde. Flytte og aendre kan ikke. @@ -2083,7 +2088,8 @@ async function haandterKald(request) { || usloeretBillede || optagStart || !!sende, - hvorfor: sende ? 'A message to a real person cannot be taken back. This yes covers this one message only.' + hvorfor: sende?.adgangskodeSide ? 'That point is inside a password manager page. Like a password manager app, it is never clicked by an agent without your yes. This yes covers this one click only.' + : sende ? 'A message to a real person cannot be taken back. This yes covers this one message only.' : hvorforSpoerg(name, args, { usloeretBillede, optagStart }) }); @@ -2226,6 +2232,8 @@ async function haandterKald(request) { } const igen = await sendeDom(name, args, targetBundleId, igenKlik); if (JSON.stringify(igen ?? null) !== JSON.stringify(sende ?? null)) { + // R9: et ja til et klik i en adgangskode-side gaelder kun den side - ikke en besked, og ikke et andet punkt. + if (sende?.adgangskodeSide || igen?.adgangskodeSide) return 'what is under that point changed after the person approved the click in a password manager page, so it was not clicked'; return 'what would be sent changed after the person approved it - who it goes to or what it says - so it was not sent'; } } diff --git a/test/bundet-maal.mjs b/test/bundet-maal.mjs index 814e89d6..663869e7 100644 --- a/test/bundet-maal.mjs +++ b/test/bundet-maal.mjs @@ -499,5 +499,30 @@ for (const [nr, tekst, args, rolle] of [ srv.kill(); } +// 12f-12h · R8 (Astra, MAALT): uden app slaar sende-dommen og knapErFarlig punktet op hver for sig. Saa sende-dommen +// «vault» (og svarede null) og det naeste opslag «en OK-knap», blev der klikket uden spoergsmaal. Raekkefoelgen +// af opslag: ejer, sende-dom, farlig-knap-dom, ejer-genmaaling, ny sende-dom (Astras fem). +{ + const V = { found: true, app: 'Google Chrome', bundleId: 'com.google.Chrome', pid: 400, role: '', title: '', description: '', window: '', password_page: true, note: 'The point is inside a password manager page; nothing from it is returned.', under: ['com.google.Chrome'] }; + const O = { ...V, role: 'AXButton', title: 'OK', window: 'Normal', password_page: false, note: '' }; + const APPS = { apps: [{ name: 'Google Chrome', bundleId: 'com.google.Chrome', pid: 400, active: false }, + { name: 'Finder', bundleId: 'com.apple.finder', pid: 300, active: true }] }; + for (const [id, hvad, raekke, svar, skalKlikke, skalSpoerge] of [ + ['12f', 'vault, vault, OK-knap, vault, vault - personen svarer ikke: spurgt, intet klik', [V, V, O, V, V], 'udloeb', false, true], + ['12g', 'personen siger ja, men genkontrollen ser ikke laengere vault: intet klik', [V, V, O, V, O], 'ja', false, true], + ['12h', 'kalibrering: personen siger ja, punktet er stadig vault: klikket sendes', [V, V, V, V, V], 'ja', true, true], + ]) { + const sp = lavFalskSpoerger(svar, 'cmcp-bundet-vault'); + const { srv, rpc, kald, hj } = klient({ apps: APPS, at: { _raekke: raekke }, samtale: { window: 'Vault' } }, { CMCP_BACKGROUND: '0', CMCP_OSASCRIPT: sp.sti }); + await rpc('initialize', { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'bundet', version: '1' } }); + const r = await kald('computer_click', { x: 10, y: 20 }); + const klik = hj.kald().filter(k => k.argv[0] === 'click'); + check(`${id} klik uden app paa en vault-side: ${hvad}`, + klik.length === (skalKlikke ? 1 : 0) && (sp.gangeSpurgt() >= 1) === skalSpoerge, + `klik ${klik.length} · spurgt ${sp.gangeSpurgt()} · ` + r.tekst.slice(0, 180)); + srv.kill(); + } +} + console.log(fails.length ? `DUMPET: ${fails.length} tjek` : 'Alle tjek bestået.'); process.exit(fails.length ? 1 : 0); diff --git a/test/chrome-dyb-side-live.mjs b/test/chrome-dyb-side-live.mjs index 636bc741..536ef3a7 100644 --- a/test/chrome-dyb-side-live.mjs +++ b/test/chrome-dyb-side-live.mjs @@ -34,29 +34,23 @@ import { fileURLToPath } from 'node:url'; const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..'); const H = process.env.CMCP_HELPER || join(ROOT, 'mcp-server', 'vendor', 'cmcp-helper'); const CHROME = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'; -if (!existsSync(CHROME)) { console.log('SPRUNGET OVER: 6 (Google Chrome er ikke installeret her) - bevist intet, ikke bestaaet'); process.exit(0); } +if (!existsSync(CHROME)) { console.log('SPRUNGET OVER: 5 (Google Chrome er ikke installeret her) - bevist intet, ikke bestaaet'); process.exit(0); } // ⛔ MAALT 5/11 kl. 02.09: mens Mac'en er LAAST, bygger Chrome ikke siders tilgaengeligheds-trae. // Et maaleprogram uden hjaelperen fandt 0 web-omraader efter 25,6 s paa en frisk Chrome (laast), // mod 2,1 s kl. 01.20 (ulaast). Proeven maaler da laasen, ikke koden - saa den siger UMAALT. { const io = execFileSync('ioreg', ['-n', 'Root', '-d1'], { encoding: 'utf8' }); - if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) { console.log('SPRUNGET OVER: 6 (skaermen er laast - Chrome bygger ingen sider imens) - bevist intet, ikke bestaaet'); process.exit(0); } + if (/CGSSessionScreenIsLocked"?\s*=\s*(Yes|true|1)/.test(io)) { console.log('SPRUNGET OVER: 5 (skaermen er laast - Chrome bygger ingen sider imens) - bevist intet, ikke bestaaet'); process.exit(0); } } // ⛔ MAALT 5/11 08.21: Chrome henter sig selv frem trods `open -g`. Kun naar personen ikke arbejder. -if (inaktivSek() < MIN_INAKTIV) { console.log(`SPRUNGET OVER: 6 (personen arbejder lige nu - inaktiv ${Math.round(inaktivSek())} s; en ny Chrome henter sig selv frem foran dem) - bevist intet, ikke bestaaet`); process.exit(0); } +if (inaktivSek() < MIN_INAKTIV) { console.log(`SPRUNGET OVER: 5 (personen arbejder lige nu - inaktiv ${Math.round(inaktivSek())} s; en ny Chrome henter sig selv frem foran dem) - bevist intet, ikke bestaaet`); process.exit(0); } let fejl = 0; const check = (navn, ok, hvorfor) => { console.log(`${ok ? 'OK ' : 'DUMP'} ${navn}${ok ? '' : ' - ' + hvorfor}`); if (!ok) fejl++; }; const hj = (args, stdin) => JSON.parse(execFileSync(H, args, { input: stdin, encoding: 'utf8', timeout: 60000 })); -// R7 (Astra, S): grunden «deeper than the scan reaches» gives pr. PROGRAM - et andet Chrome-vindue kunne give tjek 3 -// dets groenne svar. Nu: ingen saadan grund foer proevens Chrome starter (ellers springes over), og ingen efter at den -// er lukket (ellers roed, Y). Grunden matches i sin praecise form. -const DYB = /\(its page went deeper than the scan reaches - window blacked out whole\)$/; -const dybSignaler = () => (hj(['secure-rects', '--app', 'com.google.Chrome']).whole_window || []).filter((g) => DYB.test(g)); -{ - const foer = dybSignaler(); - if (foer.length) { console.log(`SPRUNGET OVER: 6 (et andet Chrome-vindue svaertes allerede af dybde-grunden - proevens svar kunne komme derfra) - bevist intet, ikke bestaaet`); process.exit(0); } -} +// R7/R8 (Astra): grunden «deeper than the scan reaches» gives pr. PROGRAM, og en for-/efterkontrol beviser ikke hvor den kom +// fra. Nu baerer grunden procesnummeret (R9: «Google Chrome [pid N] (...)»), og den skal komme fra PROEVENS Chrome. +const egenDyb = (pid) => (g) => String(g).endsWith(`[pid ${pid}] (its page went deeper than the scan reaches - window blacked out whole)`); const vent = (ms) => new Promise((r) => setTimeout(r, ms)); const mappe = mkdtempSync(join(tmpdir(), 'cmcp-chrome-')); @@ -79,6 +73,7 @@ process.on('exit', ryd); const iVinduet = (r) => r.x >= V.x - 4 && r.y >= V.y - 4 && r.x + r.w <= V.x + V.w + 4 && r.y + r.h <= V.y + V.h + 4; const heleVinduet = (r) => Math.abs(r.w - V.w) <= 8 && Math.abs(r.h - V.h) <= 8; +if (!chrome.pid) { chrome.stop(); console.log('SPRUNGET OVER: 5 (proeve-Chromens procesnummer kunne ikke findes) - bevist intet, ikke bestaaet'); process.exit(0); } try { // Vent til vinduet findes for Chromes egen brugerflade (titlen), FOER traeet roeres. let set = false; @@ -102,14 +97,10 @@ try { const r = sr.rects.filter(iVinduet); // ⛔ R2 (Astra): et hele-vindue-rektangel kan have en ANDEN grund. Kraev dybde-grunden. check('3. et felt sloeringen ikke naar, svaerter HELE vinduet - af netop den grund', - r.some(heleVinduet) && (sr.whole_window || []).some((g) => DYB.test(g)), + r.some(heleVinduet) && (sr.whole_window || []).some(egenDyb(chrome.pid)), `rekt ${JSON.stringify(r)} grunde ${JSON.stringify(sr.whole_window)}`); } finally { - const lukket = chrome.stop(); - check('Z. proevens Chrome er lukket igen', lukket, 'den lever stadig - naeste proeve ville maale dens vinduer'); - let efter = ['efterkontrollen kunne ikke koeres (proevens Chrome lever)']; - if (lukket) { try { efter = dybSignaler(); } catch (e) { efter = [`efterkontrollen fejlede: ${String(e).slice(0, 80)}`]; } } - check('Y. dybde-grunden forsvandt med proevens Chrome (den kom derfra, ikke fra et andet vindue)', efter.length === 0, JSON.stringify(efter)); + check('Z. proevens Chrome er lukket igen', chrome.stop(), 'den lever stadig - naeste proeve ville maale dens vinduer'); ryd(); } -process.exit(slutDom(fejl, 6, START_MS)); +process.exit(slutDom(fejl, 5, START_MS)); diff --git a/test/chrome-start.mjs b/test/chrome-start.mjs index 736aee0f..e151e09e 100644 --- a/test/chrome-start.mjs +++ b/test/chrome-start.mjs @@ -51,7 +51,8 @@ export async function startChrome(args) { const stop = () => { try { execFileSync('/usr/bin/pkill', ['-f', moenster]); } catch { /* allerede vaek */ } // Maal at den er vaek - en oprydning der ikke virker, var hele fejlen 08.2x. - for (let i = 0; i < 20; i++) { try { execFileSync('/usr/bin/pgrep', ['-f', moenster]); } catch { return true; } execFileSync('/bin/sleep', ['0.25']); } + // R8 (Astra, MAALT): enhver pgrep-fejl talte som «lukket». Kun status 1 betyder «ingen tilbage»; en fejl (2, 3) maaler intet. + for (let i = 0; i < 20; i++) { try { execFileSync('/usr/bin/pgrep', ['-f', moenster]); } catch (e) { if (e.status === 1) return true; } execFileSync('/bin/sleep', ['0.25']); } try { execFileSync('/usr/bin/pkill', ['-9', '-f', moenster]); } catch { /* vaek */ } return false; }; diff --git a/test/chrome-vault-live.mjs b/test/chrome-vault-live.mjs index b3e5d7c2..3ff9ebb8 100644 --- a/test/chrome-vault-live.mjs +++ b/test/chrome-vault-live.mjs @@ -10,7 +10,7 @@ // 2. find giver INTET fra siden (dens egne markoerer), og svaret siger at en adgangskode-side blev sprunget over // 3. inspect giver en «denied»-markering og intet af sidens indhold // 4. press og 5. wait-for paa sidens markoer: intet fundet, og svaret siger at en adgangskode-side blev sprunget over -// Y. naar proevens Chrome er lukket, er signalerne vaek - de kom fra den, ikke fra et andet vindue +// Hvert signal skal baere proeve-Chromens EGET procesnummer («[pid N]») - saa kan intet andet Chrome-vindue give svaret. import { execFileSync } from 'node:child_process'; import { startChrome, inaktivSek, MIN_INAKTIV, slutDom } from './chrome-start.mjs'; import { existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs'; @@ -22,7 +22,7 @@ const START_MS = Date.now(); const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..'); const H = process.env.CMCP_HELPER || join(ROOT, 'mcp-server', 'vendor', 'cmcp-helper'); -const N = 8; +const N = 7; const spring = (grund) => { console.log(`SPRUNGET OVER: ${N} (${grund}) - bevist intet, ikke bestaaet`); process.exit(0); }; if (!existsSync('/Applications/Google Chrome.app')) spring('Google Chrome er ikke installeret her'); { @@ -40,25 +40,14 @@ const M = `CMCPVAULT${Date.now().toString(36).toUpperCase()}`; const I = `INDHOLD${Math.random().toString(36).slice(2, 10).toUpperCase()}`; // ⛔ R6 (Astra, MAALT med syntetiske svar): grunden «password manager page», skipped_password_pages og denied gives -// pr. PROGRAM, ikke pr. vindue - et ANDET Chrome-vindue med en adgangskode-side kunne give proeven dens groenne svar. -// Derfor foerst: intet andet Chrome-vindue maa vise en adgangskode-side. Ellers beviser proeven intet. -// ⛔ R7 (Opus O3/O4 + Astra, MAALT 5/11): (a) «/password manager page/» ramte ogsaa ROLLE-grunden («...could not be ruled -// out as a password manager page»), saa forkontrollen sprang over paa en ulaeselig rolle i personens faner, og -// tjek 1-3 kunne bestaa paa den. Nu matches vault-grundens PRAECISE form. (b) Forkontrollen kan vaere ufuldstaendig -// (et vindue der foerst bliver laesbart senere). Derfor ogsaa en EFTERKONTROL, naar proevens Chrome er lukket: -// er signalerne der stadig, kom de ikke fra proeven, og saa er den roed (Y). -const VAULT_HEL = /\(a password manager page - window blacked out whole\)$/; // secure-rects' whole_window -const VAULT_SPRUNGET = /: a password manager page$/; // find's skipped_password_pages +// pr. PROGRAM - et ANDET Chrome-vindue med en adgangskode-side kunne give proeven dens groenne svar. +// ⛔ R7 (Opus O3/O4): «/password manager page/» ramte ogsaa ROLLE-grunden - nu matches vault-grundens PRAECISE form. +// ⛔ R8 (Astra, MAALT ved genafspilning): en for- og efterkontrol beviser intet, naar et andet vindue er ulaeseligt +// foer og efter og laesbart imens. Nu baerer hjaelperens grunde procesnummeret (R9: «Google Chrome [pid N] (...)», +// inspect-knuden «pid»), og ethvert signal skal komme fra PROEVENS Chrome-proces. For-/efterkontrollen er fjernet. +const egenHel = (pid) => (g) => String(g).endsWith(`[pid ${pid}] (a password manager page - window blacked out whole)`); +const egenSprunget = (pid) => (g) => String(g).endsWith(`[pid ${pid}]: a password manager page`); const VAULT_NOEGLE = /^This is a password manager page\./; // inspect's denied-note -const vaultSignaler = () => { - const sr = hj(['secure-rects', '--app', 'com.google.Chrome']); - const ff = hj(['find', '--app', 'com.google.Chrome', '--contains', 'ZZZCMCPINGENTINGZZZ', '--depth', '60']); - return [...(sr.whole_window || []).filter((g) => VAULT_HEL.test(g)), ...(ff.skipped_password_pages || []).filter((g) => VAULT_SPRUNGET.test(g))]; -}; -{ - const foer = vaultSignaler(); - if (foer.length) spring(`et andet Chrome-vindue viser allerede en adgangskode-side (${foer.length} signaler) - proevens svar kunne komme derfra`); -} // Selvsigneret certifikat til vault.bitwarden.com - kun i en engangs-mappe. const mappe = mkdtempSync(join(tmpdir(), 'cmcp-chrome-vault-')); @@ -79,6 +68,8 @@ const heleV = (r) => Math.abs(r.w - V.w) <= 8 && Math.abs(r.h - V.h) <= 8; const chrome = await startChrome([`--user-data-dir=${join(mappe, 'profil')}`, '--no-first-run', '--no-default-browser-check', '--disable-extensions', '--disable-session-crashed-bubble', `--window-position=${V.x},${V.y}`, `--window-size=${V.w},${V.h}`, `--host-resolver-rules=MAP vault.bitwarden.com 127.0.0.1:${port}`, '--ignore-certificate-errors', 'https://vault.bitwarden.com/']); +if (!chrome.pid) { chrome.stop(); spring('proeve-Chromens procesnummer kunne ikke findes - intet signal kan bindes til den'); } +const HEL = egenHel(chrome.pid), SPRUNGET = egenSprunget(chrome.pid); const ryd = () => { chrome.stop(); try { server.close(); } catch {} try { rmSync(mappe, { recursive: true, force: true }); } catch {} }; process.on('exit', ryd); @@ -95,23 +86,23 @@ try { let sr = { rects: [], whole_window: [] }; for (let i = 0; i < 60; i++) { sr = hj(['secure-rects', '--app', 'com.google.Chrome']); - if ((sr.whole_window || []).some((g) => VAULT_HEL.test(g))) break; + if ((sr.whole_window || []).some(HEL)) break; await vent(500); } check('1. vinduet svaertes HELT, af grunden «password manager page»', - sr.rects.filter(iV).some(heleV) && (sr.whole_window || []).some((g) => VAULT_HEL.test(g)), + sr.rects.filter(iV).some(heleV) && (sr.whole_window || []).some(HEL), `rekt ${JSON.stringify(sr.rects.filter(iV))} grunde ${JSON.stringify(sr.whole_window)}`); // 2. find: sidens EGNE markoerer findes ikke, og svaret siger hvorfor. const f = hj(['find', '--app', 'com.google.Chrome', '--contains', I, '--depth', '60', '--limit', '50']); const fraSiden = f.matches || []; check('2. find giver intet fra siden, og siger at en adgangskode-side blev sprunget over', - fraSiden.length === 0 && (f.skipped_password_pages || []).some((g) => VAULT_SPRUNGET.test(g)), + fraSiden.length === 0 && (f.skipped_password_pages || []).some(SPRUNGET), `fra siden: ${JSON.stringify(fraSiden.map((m) => m.role))} sprunget: ${JSON.stringify(f.skipped_password_pages)}`); // 3. inspect: kun en «denied»-markering; intet med sidens markoer (vinduets titel er Chromes egen - den taeller ikke). const ins = hj(['inspect', '--app', 'com.google.Chrome', '--depth', '14', '--limit', '4000']).nodes || []; - const naegtet = ins.filter((n) => n.denied && n.role === 'AXWebArea' && VAULT_NOEGLE.test(n.note || '')); + const naegtet = ins.filter((n) => n.denied && n.role === 'AXWebArea' && n.pid === chrome.pid && VAULT_NOEGLE.test(n.note || '')); const indhold = ins.filter((n) => !n.denied && JSON.stringify([n.title, n.value, n.desc]).includes(I)); check('3. inspect giver en «denied»-markering og intet af sidens indhold', naegtet.length > 0 && indhold.length === 0, `naegtet ${naegtet.length}, med sidens markoer: ${indhold.map((n) => n.role).join(', ')}`); @@ -121,22 +112,14 @@ try { const afslag = (args) => { try { return hj(args); } catch (e) { try { return JSON.parse(e.stdout || '{}'); } catch { return {}; } } }; const p4 = afslag(['press', '--app', 'com.google.Chrome', '--contains', `${I}-TEKST`, '--depth', '60', '--dry']); check('4. press paa sidens tekst: intet fundet, og svaret siger at en adgangskode-side blev sprunget over', - p4.ok === false && p4.code === 'not-found' && (p4.skipped_password_pages || []).some((g) => VAULT_SPRUNGET.test(g)), + p4.ok === false && p4.code === 'not-found' && (p4.skipped_password_pages || []).some(SPRUNGET), JSON.stringify(p4).slice(0, 200)); const w5 = afslag(['wait-for', '--app', 'com.google.Chrome', '--contains', `${I}-TEKST`, '--depth', '60', '--timeout', '2']); check('5. wait-for paa sidens tekst: tidsudloeb, og svaret siger at en adgangskode-side ikke blev gennemsoegt', - w5.ok === false && w5.code === 'wait-timeout' && (w5.skipped_password_pages || []).some((g) => VAULT_SPRUNGET.test(g)), + w5.ok === false && w5.code === 'wait-timeout' && (w5.skipped_password_pages || []).some(SPRUNGET), JSON.stringify(w5).slice(0, 200)); } finally { - const lukket = chrome.stop(); - check('Z. proevens Chrome er lukket igen', lukket, 'den lever stadig'); - // Y. Efterkontrollen: med proevens Chrome lukket maa ingen vault-signaler vaere tilbage. Er de det, kom de fra - // et andet vindue, og tjek 1-3 kan have bestaaet paa det - saa beviser proeven intet, og den er roed. - if (lukket) { - let efter = []; - try { efter = vaultSignaler(); } catch (e) { efter = [`efterkontrollen fejlede: ${String(e).slice(0, 80)}`]; } - check('Y. signalerne forsvandt med proevens Chrome (de kom derfra, ikke fra et andet vindue)', efter.length === 0, JSON.stringify(efter)); - } else check('Y. efterkontrollen kunne ikke koeres (proevens Chrome lever)', false, 'Z fejlede'); + check('Z. proevens Chrome er lukket igen', chrome.stop(), 'den lever stadig'); ryd(); } process.exit(slutDom(fejl, N, START_MS)); diff --git a/test/claims-offline.mjs b/test/claims-offline.mjs index 43867d86..dd62edbd 100644 --- a/test/claims-offline.mjs +++ b/test/claims-offline.mjs @@ -231,6 +231,14 @@ check('kontakten kan slaas fra, saa tallet kan efterproeves udefra', 'find eller inspect regner nil-id for ikke-browser'); check('vault-porten: fokus i en adgangskode-side kaldes ikke et «secure field» (set-value siger hvad det er)', /if fokusVej, let g = AX\.iVaultSide\(t\.el\) \{\s*Out\.fail\("the keyboard focus is inside/.test(mainSw), 'set-value bruger stadig secure-field-teksten'); + // R9 (Astra R8-4): grundene baerer procesnummeret - ellers kan en proeve ikke binde et signal til sin egen Chrome. + check('grundene baerer procesnummeret (alle otte steder, og inspects vault-knude har pid)', + /static func etiket\(_ app: NSRunningApplication, _ bid: String\) -> String \{\s*"\\\(app\.localizedName \?\? bid\) \[pid \\\(app\.processIdentifier\)\]"/.test(sw) + && (sw.match(/etiket\(app, /g) || []).length === 8 && !/\(app\.localizedName \?\? bid\) \+ "/.test(sw) + && /"pid": Int\(app\.processIdentifier\),\s*"role": role, "depth": d, "denied": true/.test(sw), + 'en grund uden pid, eller etiket-funktionen er aendret'); + check('vault-porten: en side hvis adresse ikke kunne laeses, goer find og inspect ufuldstaendige', + (sw.match(/if g == vaultUkendtGrund \{ stoppedeTidligt = true \}/g) || []).length === 2, 'find eller inspect mangler reglen'); check('vault-porten: wait-for og et tomt soegeresultat siger, at adgangskode-sider ikke blev gennemsoegt', /password manager page\(s\) were not searched; their content is never returned/.test(mainSw) && /password manager page\(s\) were not searched; like password manager apps/.test(mainSw), 'wait-for eller not-found tier om sprungne sider'); @@ -239,6 +247,7 @@ check('kontakten kan slaas fra, saa tallet kan efterproeves udefra', const LOEFTER = [ // R9 (A6): en binaer uden beskeden om sprungne adgangskode-sider kan ikke bestaa. ['were not searched; their content is never returned', 'wait-for siger naar en adgangskode-side ikke blev gennemsoegt'], + ['could not be read to rule out a password manager', 'et ufuldstaendigt svar navngiver ogsaa den ulaeselige adresse'], ['AXManualAccessibility', 'virker inde i Electron-programmer'], ['AXSecureTextField', 'kodeordsfelter kan findes og sloeres'], ['AXMenu', 'menuer kan laeses'], From 9ae7a647d0360fd55df8f4f6d323978163ec1248 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Thu, 5 Nov 2026 12:26:05 +0100 Subject: [PATCH 59/94] R9c efter R8 (Opus GODKENDT MED RETTELSER): genkontrollen kalder kun en genkendt side en adgangskode-side, 12e over alle seks grunde, spoergsmaalet naevner siden - index.js: genkontrollens afslag foelger noten - en side der ikke kunne afgoeres siges som det (Opus R8-O6, 12b2) - bundet-maal 12e: alle seks ikke-genkendte grunde beholder sende-dommen; Opus' mutant (/password manager/) er nu roed (O5) - 12f/12h: spoergsmaalet til personen naevner adgangskode-siden (O4) - CHANGELOG: den braekkede saetning (O7), 12b2/12e/spoergsmaalet - hjaelperen uaendret: kandidaten 88866507 gaelder Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 14 +++++++------ mcp-server/index.js | 5 ++++- test/bundet-maal.mjs | 50 ++++++++++++++++++++++++++++---------------- 3 files changed, 44 insertions(+), 25 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 6b52dd05..592d52bf 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -59,10 +59,11 @@ click gate's lookup (the answer says what was left out), its window is blacked o in screenshots, typing (also the direct accessibility route) is refused, and a click is refused (without an app named, which needs foreground mode, it asks every time - the send gate no longer mistakes such a page, with its empty title, for a chat: `test/bundet-maal.mjs` -12d; a page that could not be checked might be a web chat, and keeps the send gate: 12e). The send gate's own +12d; a page that could not be checked might be a web chat, and keeps the send gate - every +such reason the helper gives: 12e). The send gate's own lookup marks the page, so a second lookup that happens to see an ordinary button cannot turn the click into one that is not asked (12f-12h, the review's five-lookup sequence; mutation-proven), and the yes cannot come from the -menu bar, as for password manager apps. A web page whose address cannot be read - in any app, since the address rule applies +menu bar, as for password manager apps; the question says the point is inside a password manager page. A web page whose address cannot be read - in any app, since the address rule applies to web areas everywhere - or an element whose role cannot be read in a browser counts as one that cannot be ruled out. `version` lists `browser-password-pages`; `vault-url --url` answers the address rule on its @@ -73,10 +74,11 @@ the gate, a failed window lookup counting as unreadable, the segment rule for ot channels, the size rule regardless of role, the role and app checks in the focus walk, and the two small-window rules - Chrome makes `window.open` popups at least 520x446 (measured), so no test can reach a smaller one - the role checks that skip a browser branch in find and -inspect (and mark the answer incomplete, so a write never picks the one match left), the -and the empty role in a password-page answer for older servers. The click gate's recheck -just before the click has a test of its own (`test/bundet-maal.mjs` 12a-12c: an unchanged -point is clicked, a point that became a password page or cannot be looked up again is not; +inspect (and mark the answer incomplete, so a write never picks the one match left), and +the empty role in a password-page answer for older servers. The click gate's recheck just +before the click has a test of its own (`test/bundet-maal.mjs` 12a-12c and 12b2: an unchanged +point is clicked, a point that became a password page, could no longer be ruled out, or cannot +be looked up again is not; two mutants turn it red). The check sits on the web area, not the window, so a suggestion menu inside another page is covered too, and it applies in any browser that exposes the address (extension pages: Chrome and Edge only). Not covered: self-hosted vaults, diff --git a/mcp-server/index.js b/mcp-server/index.js index 62ad2ace..a7cbce1b 100644 --- a/mcp-server/index.js +++ b/mcp-server/index.js @@ -2221,7 +2221,10 @@ async function haandterKald(request) { let nuKlik = null; try { nuKlik = await callHelper(['at', '--app', appVaerdi(args, targetBundleId), '--x', String(args.x), '--y', String(args.y)], { timeout: 8000 }); } catch {} if (!nuKlik?.found) return 'what is under that point could not be checked again just before the click'; - if (nuKlik.password_page) return 'the point is now inside a password manager page, which is never clicked by an agent - ask the person to do this step with computer_ask_user'; + // R8 (Opus O6): kun en GENKENDT side kaldes en adgangskode-side; en der ikke kunne afgoeres, siges som det den er. + if (nuKlik.password_page) return /^The point is inside a password manager page;/.test(String(nuKlik.note || '')) + ? 'the point is now inside a password manager page, which is never clicked by an agent - ask the person to do this step with computer_ask_user' + : 'what is under that point could no longer be ruled out as a password manager page, so it is not clicked by an agent - ask the person to do this step with computer_ask_user'; } if (beskedSlags(targetBundleId)) { // R27: et klik med `app` genmaales I maalprogrammet, ligesom det blev doemt. diff --git a/test/bundet-maal.mjs b/test/bundet-maal.mjs index 663869e7..249ddaca 100644 --- a/test/bundet-maal.mjs +++ b/test/bundet-maal.mjs @@ -444,12 +444,14 @@ for (const [nr, tekst, args, rolle] of [ // under laasen; attrappen svarer i raekkefoelge. 12a kalibrerer: et uaendret punkt klikkes stadig. { const OK = { found: true, app: 'Notes', bundleId: 'com.apple.Notes', pid: 3303, role: 'AXButton', title: 'OK', description: '', window: 'Note', window_number: 777, under: ['com.apple.finder'] }; - const VAULT = { ...OK, role: '', title: '', description: '', window: '', password_page: true, note: 'a password manager page' }; + const VAULT = { ...OK, role: '', title: '', description: '', window: '', password_page: true, note: 'The point is inside a password manager page; nothing from it is returned.' }; + const UAFGJORT = { ...VAULT, note: 'The point is inside a page whose address could not be read, so it could not be ruled out as a password manager; nothing from it is returned.' }; const ULAESELIG = { found: false, under: [], why: 'the point could not be read' }; for (const [id, hvad, anden, skalKlikke, moenster] of [ ['12a', 'punktet er uaendret: klikket sendes (genkontrollen spaerrer ikke et almindeligt klik)', OK, true, null], ['12b', 'punktet er nu i en adgangskode-side: intet klik, og svaret beder agenten spoerge personen - ikke «kald igen»', VAULT, false, /now inside a password manager page/], ['12c', 'punktet kan ikke slaas op igen: intet klik', ULAESELIG, false, /could not be checked again just before the click/], + ['12b2', 'punktet kunne ikke afgoeres: intet klik, og svaret kalder det ikke en adgangskode-side (R8-O6)', UAFGJORT, false, /could no longer be ruled out as a password manager page/], ]) { const { srv, rpc, kald, hj } = klient({ apps: APPS8, at: OK, 'at --app': { _raekke: [OK, anden] } }); await rpc('initialize', { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'bundet', version: '1' } }); @@ -481,22 +483,32 @@ for (const [nr, tekst, args, rolle] of [ srv.kill(); } -// 12e · Modstykket: en side hvis adresse IKKE kunne laeses, er ogsaa password_page (fejl-lukket) - men den kan vaere en -// webchat. Den maa ikke slippe uden om sende-dommen og blive et almindeligt «farligt klik», hvor personen godkender -// uden at se modtager og tekst. Sende-dommen skal stadig afvise (som foer 12d-rettelsen). +// 12e · Modstykket: en side der IKKE er genkendt som vault, men heller ikke kunne udelukkes, er ogsaa password_page +// (fejl-lukket) - og den kan vaere en webchat. Den maa ikke slippe uden om sende-dommen og blive et almindeligt +// «farligt klik», hvor personen godkender uden at se modtager og tekst. R8 (Opus O5): ALLE hjaelperens grunde af +// den slags (iVaultSide/vaultGrund i Accessibility.swift), ikke kun én - et udvidet moenster skal blive roedt her. { - const UKENDT = { found: true, app: 'Google Chrome', bundleId: 'com.google.Chrome', pid: 400, role: '', title: '', description: '', window: '', password_page: true, note: 'The point is inside an element in a browser whose page could not be checked; nothing from it is returned.', under: ['com.google.Chrome'] }; - const { srv, rpc, kald, hj, spoerger } = klient({ - apps: { apps: [{ name: 'Google Chrome', bundleId: 'com.google.Chrome', pid: 400, active: false }, - { name: 'Finder', bundleId: 'com.apple.finder', pid: 300, active: true }] }, - at: UKENDT, samtale: { window: 'WhatsApp' } }, { CMCP_BACKGROUND: '0' }); - await rpc('initialize', { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'bundet', version: '1' } }); - const r = await kald('computer_click', { x: 10, y: 20 }); - const klik = hj.kald().filter(k => k.argv[0] === 'click'); - check('12e en side der ikke kunne afgoeres (maaske en webchat): sende-dommen afviser stadig, ingen spurgt, intet klik', - klik.length === 0 && spoerger.gangeSpurgt() === 0 && r.fejl && /Send control|Nothing was sent/.test(r.tekst), - `klik ${klik.length} · spurgt ${spoerger.gangeSpurgt()} · ` + r.tekst.slice(0, 200)); - srv.kill(); + const GRUNDE = ['a page whose address could not be read, so it could not be ruled out as a password manager', + 'a page that looks like a password manager (it has no address)', + 'an element whose app and page could not be checked', + 'an element whose app could not be identified, so its page could not be checked', + 'an element in a browser whose page could not be checked', + 'a browser element whose role could not be read, so it could not be ruled out as a password manager page']; + const udfald = []; + for (const g of GRUNDE) { + const UKENDT = { found: true, app: 'Google Chrome', bundleId: 'com.google.Chrome', pid: 400, role: '', title: '', description: '', window: '', password_page: true, note: `The point is inside ${g}; nothing from it is returned.`, under: ['com.google.Chrome'] }; + const { srv, rpc, kald, hj, spoerger } = klient({ + apps: { apps: [{ name: 'Google Chrome', bundleId: 'com.google.Chrome', pid: 400, active: false }, + { name: 'Finder', bundleId: 'com.apple.finder', pid: 300, active: true }] }, + at: UKENDT, samtale: { window: 'WhatsApp' } }, { CMCP_BACKGROUND: '0' }); + await rpc('initialize', { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'bundet', version: '1' } }); + const r = await kald('computer_click', { x: 10, y: 20 }); + const klik = hj.kald().filter(k => k.argv[0] === 'click'); + udfald.push({ g: g.slice(0, 40), ok: klik.length === 0 && spoerger.gangeSpurgt() === 0 && r.fejl && /Send control|Nothing was sent/.test(r.tekst), klik: klik.length, spurgt: spoerger.gangeSpurgt() }); + srv.kill(); + } + check(`12e alle ${GRUNDE.length} grunde der ikke er en genkendt vault (maaske en webchat): sende-dommen afviser stadig, ingen spurgt, intet klik`, + udfald.every(u => u.ok), JSON.stringify(udfald.filter(u => !u.ok))); } // 12f-12h · R8 (Astra, MAALT): uden app slaar sende-dommen og knapErFarlig punktet op hver for sig. Saa sende-dommen @@ -518,8 +530,10 @@ for (const [nr, tekst, args, rolle] of [ const r = await kald('computer_click', { x: 10, y: 20 }); const klik = hj.kald().filter(k => k.argv[0] === 'click'); check(`${id} klik uden app paa en vault-side: ${hvad}`, - klik.length === (skalKlikke ? 1 : 0) && (sp.gangeSpurgt() >= 1) === skalSpoerge, - `klik ${klik.length} · spurgt ${sp.gangeSpurgt()} · ` + r.tekst.slice(0, 180)); + klik.length === (skalKlikke ? 1 : 0) && (sp.gangeSpurgt() >= 1) === skalSpoerge + // R8 (Opus O4): personen skal kunne se, at et ja klikker INDE i en adgangskode-side + && sp.tekster().some(x => /password manager page/.test(x)), + `klik ${klik.length} · spurgt ${sp.gangeSpurgt()} · spoergsmaal ${JSON.stringify(sp.tekster().map(x => x.slice(0, 90)))} · ` + r.tekst.slice(0, 140)); srv.kill(); } } From e0c2be96e4c33e642e36343e06c222cfba7281df Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Thu, 5 Nov 2026 12:56:00 +0100 Subject: [PATCH 60/94] =?UTF-8?q?R9d=20efter=20Astra=20R9=20(IKKE=20GODKEN?= =?UTF-8?q?DT):=20=C3=A9t=20opslag=20doemmer=20et=20klik=20uden=20app,=20j?= =?UTF-8?q?a'et=20bindes=20til=20samme=20side,=20i=20alle=20browsere?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - index.js: ejer-opslaget for et klik uden app genbruges af sende-dommen og knapErFarlig (ingen egne opslag); et punkt i en adgangskode-side (genkendt eller ikke udelukket) kraever altid et ja, aldrig via menulinjen, uanset beskedlisten (Chrome Beta, Firefox Nightly); genmaalingen under laasen kraever samme pid, ramme og grund, og et punkt der er blevet en adgangskode-side klikkes ikke paa et ja til noget andet - bundet-maal 12f-12k (Astras R9-sekvenser, Beta, Nightly, anden proces, andet element, almindeligt->vault); 11a maaler samme egenskab i den nye form (genmaalingen afviser) - chrome-start: frister paa oprydningens proceskald - flader: «sagde de sprang en over» kun naar intet blev fundet; pid-loeftet afgraenset; CHANGELOG om ét opslag og bindingen - hjaelperen uaendret: kandidaten 88866507 gaelder Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 14 +++++++++----- README.md | 3 ++- docs/llms.txt | 2 +- docs/security.html | 2 +- mcp-server/README.md | 3 ++- mcp-server/index.js | 44 +++++++++++++++++++++++++++++++++---------- test/bundet-maal.mjs | 44 ++++++++++++++++++++++++++----------------- test/chrome-start.mjs | 7 ++++--- 8 files changed, 80 insertions(+), 39 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 592d52bf..4ec40822 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -60,10 +60,14 @@ in screenshots, typing (also the direct accessibility route) is refused, and a c refused (without an app named, which needs foreground mode, it asks every time - the send gate no longer mistakes such a page, with its empty title, for a chat: `test/bundet-maal.mjs` 12d; a page that could not be checked might be a web chat, and keeps the send gate - every -such reason the helper gives: 12e). The send gate's own -lookup marks the page, so a second lookup that happens to see an ordinary button cannot turn the click into one -that is not asked (12f-12h, the review's five-lookup sequence; mutation-proven), and the yes cannot come from the -menu bar, as for password manager apps; the question says the point is inside a password manager page. A web page whose address cannot be read - in any app, since the address rule applies +such reason the helper gives: 12e). A click without an +app is judged by ONE lookup of the point (its owner, the send gate and the dangerous-click rule all use it), so a +second lookup that happens to see an ordinary button cannot turn it into a click that is not asked - in any browser, +not only those the send gate knows (`test/bundet-maal.mjs` 12f-12i2, the reviews' sequences, Chrome Beta and Firefox +Nightly included). A point inside such a page always asks, the yes cannot come from the menu bar, as for password +manager apps, and the question says the point is inside a password manager page. The yes covers that page only: the +lookup just before the click must show the same process, element frame and reason (12j, 12j2), and a point that +became such a page while an ordinary click waited is not clicked (12k). A web page whose address cannot be read - in any app, since the address rule applies to web areas everywhere - or an element whose role cannot be read in a browser counts as one that cannot be ruled out. `version` lists `browser-password-pages`; `vault-url --url` answers the address rule on its @@ -86,7 +90,7 @@ unlisted extensions, Safari's and Firefox's extension pages, window and menu tit for native apps), Chrome's own password bubbles and autofill rows (native panels, not pages), screen recordings, and a vault navigated away from in the instant between capture and scan. It is a guard against accidents, not a fence: non-text keys, -developer tools and the clipboard are not covered. Test: `test/chrome-vault-live.mjs` against a real vault address (`https://vault.bitwarden.com`, served locally over HTTPS and pointed at with `--host-resolver-rules`; Chrome does not open its own password page from the command line). Every reason now carries the process it came from (`Google Chrome [pid 4321] (...)`, and `pid` on inspect's denied node), because two Chrome processes share one name: the test requires each signal to come from its own Chrome process and matches the vault reason's exact wording (not the "role could not be read" reason); a check before and after, which an unreadable window elsewhere could fool, was dropped. `test/chrome-dyb-side-live.mjs` binds its depth reason the same way. +developer tools and the clipboard are not covered. Test: `test/chrome-vault-live.mjs` against a real vault address (`https://vault.bitwarden.com`, served locally over HTTPS and pointed at with `--host-resolver-rules`; Chrome does not open its own password page from the command line). Every whole-window and skipped-page reason tied to an app now carries the process it came from (`Google Chrome [pid 4321] (...)`, and `pid` on inspect's denied password-page node), because two Chrome processes share one name: the test requires each signal to come from its own Chrome process and matches the vault reason's exact wording (not the "role could not be read" reason); a check before and after, which an unreadable window elsewhere could fool, was dropped. `test/chrome-dyb-side-live.mjs` binds its depth reason the same way. After the third review (R7-R9, 5 Nov): `computer_press`, `computer_set_value` and `computer_wait_for` say when they skipped a password manager page (`skipped_password_pages`) diff --git a/README.md b/README.md index d8e6b7b8..0aed3589 100644 --- a/README.md +++ b/README.md @@ -534,7 +534,8 @@ sit unnoticed until it expires. That is a real limitation today, not a setting. and Edge - also as a suggestion menu inside another page - is never returned by `computer_find`, `computer_inspect`, `computer_focused` or the click gate (`computer_press`, `computer_set_value` and `computer_wait_for` say when they - skipped one, instead of only "nothing matched"), its window is blacked out whole + skipped one and then found nothing or ran out of time, instead of only "nothing + matched"), its window is blacked out whole in screenshots, typing there is refused, and a click there is refused (or, without an app named, which needs foreground mode, asks every time) - like password manager apps. The address rule applies to a web page diff --git a/docs/llms.txt b/docs/llms.txt index 8f73253c..58147ac3 100644 --- a/docs/llms.txt +++ b/docs/llms.txt @@ -115,7 +115,7 @@ under a friendlier name. can be missing from the tree while it shows. Password managers inside a browser (the browser's own password page, known web vaults, eighteen known extensions - also as a suggestion menu in another page) are never returned by find, inspect or focused - (press, set_value and wait_for say when they skipped one), + (press, set_value and wait_for say when they skipped one and found nothing), their window is blacked out whole, typing there is refused, and a click there is refused or asks every time, like password manager apps. The address rule applies to a web page in any app; a page whose address, or a browser element whose role, cannot diff --git a/docs/security.html b/docs/security.html index e9cf0a07..a40b1ae1 100644 --- a/docs/security.html +++ b/docs/security.html @@ -199,7 +199,7 @@

Gate 1 - redaction happens before the file exists

Had we written the file first and redacted after, there would be a window - short, but real - where an unredacted picture of your desktop sat on disk for any other process to read. A security property with a race in it is not a security property.

Two things get painted:

    -
  • Secure text fields. Native fields expose the role AXSecureTextField. Fields in a web page expose the role AXTextField with the subrole AXSecureTextField. Checking only the role catches native fields and lets every browser password box through - which is the case that actually matters. We check both. A field in a web page is only visible once the browser shows its page to the accessibility layer: in Chrome this server switches that on (the switch a screen reader uses), and while a Chrome window's page is not readable yet - still being built, 3 to 15 seconds after it is first switched on, measured on Chrome 156, or empty - the whole window is painted over instead. Not covered: Safari, Firefox, Chromium browsers we do not name, Chrome app windows, and any browser when CMCP_INGEN_ELECTRON=1 is set. Known gaps, not measured: a field in a cross-site frame, or a login step that appears before Chrome has updated its tree. Password managers inside a browser are treated like native ones: a page whose address is the browser's own password page, a known web vault or one of eighteen known password-manager extensions in Chrome and Edge (also as a suggestion menu inside another page) is never returned by the reading tools (and the acting tools say when they skipped one), its window is blacked out whole, typing there is refused, and a click there is refused (or, without an app named, which needs foreground mode, asks every time) - like password manager apps. The address rule applies to a web page in any app, not only a browser; a page whose address, or a browser element whose role, cannot be read is kept out of the reading tools too, and a search then says it was incomplete. Not recognised: a self-hosted vault, an unlisted extension, Safari's and Firefox's extension pages. Not hidden: window and menu titles (as for native apps), screen recordings, and Chrome's own password bubbles and autofill rows, which are native panels rather than pages. It is a guard against accidents, not a fence: keys that are not text, developer tools and the clipboard are not covered.
    • +
  • Secure text fields. Native fields expose the role AXSecureTextField. Fields in a web page expose the role AXTextField with the subrole AXSecureTextField. Checking only the role catches native fields and lets every browser password box through - which is the case that actually matters. We check both. A field in a web page is only visible once the browser shows its page to the accessibility layer: in Chrome this server switches that on (the switch a screen reader uses), and while a Chrome window's page is not readable yet - still being built, 3 to 15 seconds after it is first switched on, measured on Chrome 156, or empty - the whole window is painted over instead. Not covered: Safari, Firefox, Chromium browsers we do not name, Chrome app windows, and any browser when CMCP_INGEN_ELECTRON=1 is set. Known gaps, not measured: a field in a cross-site frame, or a login step that appears before Chrome has updated its tree. Password managers inside a browser are treated like native ones: a page whose address is the browser's own password page, a known web vault or one of eighteen known password-manager extensions in Chrome and Edge (also as a suggestion menu inside another page) is never returned by the reading tools (and the acting tools say when they skipped one and found nothing), its window is blacked out whole, typing there is refused, and a click there is refused (or, without an app named, which needs foreground mode, asks every time) - like password manager apps. The address rule applies to a web page in any app, not only a browser; a page whose address, or a browser element whose role, cannot be read is kept out of the reading tools too, and a search then says it was incomplete. Not recognised: a self-hosted vault, an unlisted extension, Safari's and Firefox's extension pages. Not hidden: window and menu titles (as for native apps), screen recordings, and Chrome's own password bubbles and autofill rows, which are native panels rather than pages. It is a guard against accidents, not a fence: keys that are not text, developer tools and the clipboard are not covered.
  • Whole windows of listed apps. Keychain Access, 1Password, Bitwarden, LastPass, Dashlane, Apple Passwords. We do not walk into those windows to decide what to hide; descending into a vault to work out what is secret is the mistake we are avoiding.

The rectangles are painted solid black, not blurred or pixelated. A good enough model can read through pixelation. It cannot read through black.

diff --git a/mcp-server/README.md b/mcp-server/README.md index 98c22bb3..75e08176 100644 --- a/mcp-server/README.md +++ b/mcp-server/README.md @@ -532,7 +532,8 @@ sit unnoticed until it expires. That is a real limitation today, not a setting. and Edge - also as a suggestion menu inside another page - is never returned by `computer_find`, `computer_inspect`, `computer_focused` or the click gate (`computer_press`, `computer_set_value` and `computer_wait_for` say when they - skipped one, instead of only "nothing matched"), its window is blacked out whole + skipped one and then found nothing or ran out of time, instead of only "nothing + matched"), its window is blacked out whole in screenshots, typing there is refused, and a click there is refused (or, without an app named, which needs foreground mode, asks every time) - like password manager apps. The address rule applies to a web page diff --git a/mcp-server/index.js b/mcp-server/index.js index a7cbce1b..0deb16c2 100644 --- a/mcp-server/index.js +++ b/mcp-server/index.js @@ -677,11 +677,11 @@ async function trykForhaand(args) { /// Klikkets halvdel af porten. Trykkets ligger i `trykForhaand` (7/10): et klik kan /// ramme noget tilgaengelighedslaget ikke ser (canvas, fjernskrivebord), saa «intet /// fundet» spoerger her fortsat - et tryk uden fundet element kan slet ikke ske. -async function knapErFarlig(name, args, appKlik = null) { +async function knapErFarlig(name, args, appKlik = null, forhaand = null) { if (name === 'computer_click' && Number.isFinite(args.x) && Number.isFinite(args.y)) { try { // R27: med `app` er det maalprogrammets eget element (doemt i porten), ikke det oeverste vindue. - const d = appKlik || await callHelper(['at', '--x', String(args.x), '--y', String(args.y)], { timeout: 8000 }); + const d = appKlik || forhaand || await callHelper(['at', '--x', String(args.x), '--y', String(args.y)], { timeout: 8000 }); if (!d?.found) return true; // R4 5/11 (Astra): et punkt i en adgangskode-side inde i en browser er lige saa farligt som et adgangskode-program. if (d.password_page) return true; @@ -693,7 +693,7 @@ async function knapErFarlig(name, args, appKlik = null) { return false; } -async function sendeDom(name, args, bid, appKlik = null) { +async function sendeDom(name, args, bid, appKlik = null, forhaand = null) { let slags = beskedSlags(bid); if (!slags) return null; let s = null; @@ -711,7 +711,7 @@ async function sendeDom(name, args, bid, appKlik = null) { kontrolSvar = el ? { navne: [el.name, ...(el.names || []), el.title], rolle: el.role, vindue: el.window || null, ramme: el.frame || null, fundet: true } : { fejl: true }; } else if (name === 'computer_click') { - const d = appKlik || await callHelper(['at', '--x', String(args.x), '--y', String(args.y)], { timeout: 8000 }); + const d = appKlik || forhaand || await callHelper(['at', '--x', String(args.x), '--y', String(args.y)], { timeout: 8000 }); kontrolSvar = { navne: [d.title, d.description], rolle: d.role, vindue: d.window || null, ramme: d.frame || null, fundet: !!d.found, andetProgram: d.bundleId !== bid, // KUN en genkendt adgangskode-side (hjaelperens note, main.swift `at`). En side hvis adresse ikke @@ -1688,6 +1688,10 @@ async function haandterKald(request) { const GLOBALT_INPUT = new Set(['computer_type', 'computer_key', 'computer_paste', 'computer_set_value']); // Hvad laa under punkterne da porten vurderede? Genmaales inde i laasen. let koordinatPunkter = null, koordinatEjereFoer = null; + // R9d (Astra R9-1/R9-2, MAALT): et klik uden app blev slaaet op op til fem gange, og hver dom brugte sit eget opslag - + // saa «vault» i ét og «OK-knap» i et andet gav et klik uden ja (ogsaa i browsere uden for beskedlisten). Nu doemmer + // ÉT opslag alt (ejer, sende-dom, farlig-knap-dom), og genmaalingen under laasen binder ja'et til samme side. + let koordinatOpslag = null; // ⛔ Runde 2: `computer_double_click` og `computer_right_click` stod her, men // findes ikke - dobbelt- og hoejreklik er `computer_click` med count/button. // `computer_scroll` uden app lander under markoeren; den vurderes ved markoeren. @@ -1705,6 +1709,7 @@ async function haandterKald(request) { let ejer = null; try { ejer = await callHelper(vedMarkoer ? ['at', '--pointer'] : ['at', '--x', String(x), '--y', String(y)], { timeout: 8000 }); } catch {} if (ejer?.found && ejer.bundleId) ejere.push(ejer.bundleId); else ejerUkendt = true; + if (name === 'computer_click' && punkter.length === 1 && !vedMarkoer && ejer?.found) koordinatOpslag = ejer; // Vindues-stakken over punktet: klikket rammes af vindues-serveren, ikke af // tilgaengeligheds-laget. Alle kandidater vurderes (Fable, runde 2). for (const u of (Array.isArray(ejer?.under) ? ejer.under : [])) if (typeof u === 'string' && u && !ejere.includes(u)) ejere.push(u); @@ -2039,7 +2044,11 @@ async function haandterKald(request) { } args[KLIK_VINDUE] = appKlik.window_number; } - const sende = (effektivTier === TIER.READ || kunLaes) ? null : await sendeDom(name, args, targetBundleId, appKlik); + const sende = (effektivTier === TIER.READ || kunLaes) ? null : await sendeDom(name, args, targetBundleId, appKlik, koordinatOpslag); + // Et klik uden app i en adgangskode-side - genkendt eller ikke udelukket - kraever ALTID et ja, aldrig via menulinjen, + // uanset om browseren staar paa beskedlisten (R9d, Astra R9-1: Chrome Beta og Firefox Nightly klikkede uden ja). + const vaultKlik = name === 'computer_click' && !args.app && koordinatOpslag?.password_page === true; + const kendtVaultKlik = vaultKlik && /^The point is inside a password manager page;/.test(String(koordinatOpslag.note || '')); if (sende?.afvis) { record({ tool: name, tier: tool.tier, args: scrubArgs(args), mode: currentMode(), target: targetBundleId, decision: 'denied', asked: false, reason: `send port: ${sende.afvis}` }); @@ -2050,7 +2059,7 @@ async function haandterKald(request) { && (menuSerFarlig(args.path) || await menuGenvejErFarlig(appArg(args), args.path)); const knapFarlig = effektivTier !== TIER.READ && !kunLaes && ( name === 'computer_press' ? !!trykDom?.farlig - : name === 'computer_click' ? await knapErFarlig(name, args, appKlik) : false); + : name === 'computer_click' ? await knapErFarlig(name, args, appKlik, koordinatOpslag) : false); // R47 (Astra): hvilket sessionssamtykke fandtes FOER dette kalds spoergsmaal - saa et stoppet kalds sene ja kun // tager det tilbage, DET selv gav, og ikke et nyere ja mennesket har givet et andet kald imens. @@ -2071,7 +2080,7 @@ async function haandterKald(request) { // («Type 11 characters»). Status og koe beholder den korte tekst. tier: effektivTier, targetBundleId, describe: sende?.describe || describe(name, args), ikon: { session: SESSION, client: server.getClientVersion?.()?.name || process.env.CMCP_CLIENT || null }, - aldrigViaIkonet: usloeretBillede || sende?.adgangskodeSide === true, + aldrigViaIkonet: usloeretBillede || sende?.adgangskodeSide === true || vaultKlik, // Et menupunkt der ser ud til at slette noget, spoerger hver gang - // ogsaa i allow, som et farligt program. // At lukke et vindue kan tabe ugemt arbejde. Flytte og aendre kan ikke. @@ -2087,8 +2096,9 @@ async function haandterKald(request) { || name === 'computer_space' || usloeretBillede || optagStart - || !!sende, - hvorfor: sende?.adgangskodeSide ? 'That point is inside a password manager page. Like a password manager app, it is never clicked by an agent without your yes. This yes covers this one click only.' + || !!sende || vaultKlik, + hvorfor: (sende?.adgangskodeSide || kendtVaultKlik) ? 'That point is inside a password manager page. Like a password manager app, it is never clicked by an agent without your yes. This yes covers this one click only.' + : vaultKlik ? 'That point is inside a page that could not be ruled out as a password manager page, so it is never clicked by an agent without your yes. This yes covers this one click only.' : sende ? 'A message to a real person cannot be taken back. This yes covers this one message only.' : hvorforSpoerg(name, args, { usloeretBillede, optagStart }) }); @@ -2173,6 +2183,7 @@ async function haandterKald(request) { // klikkede uden at nogen bekraeftede hvad der nu laa under punktet. // Nu maales der altid; var foer-maengden ukendt, skal nu-maengden vaere // kendt og fri for adgangskode-programmer og terminaler. + let nuKoordinat = null; if (koordinatPunkter) { const nu = []; for (const [x, y] of koordinatPunkter) { @@ -2181,6 +2192,7 @@ async function haandterKald(request) { let e = null; try { e = await callHelper(vedMarkoer ? ['at', '--pointer'] : ['at', '--x', String(x), '--y', String(y)], { timeout: 8000 }); } catch {} if (!(e?.found && e.bundleId)) return 'the window under that point could not be confirmed just before acting'; + if (koordinatOpslag && !vedMarkoer) nuKoordinat = e; for (const b of [e.bundleId, ...(Array.isArray(e.under) ? e.under : [])]) if (typeof b === 'string' && b && !nu.includes(b)) nu.push(b); } const somMaengde = (a) => [...new Set(a)].sort().join('|'); @@ -2195,6 +2207,18 @@ async function haandterKald(request) { } else if (somMaengde(nu) !== somMaengde(koordinatEjereFoer)) { return `the window under that point changed while the agent waited (was ${koordinatEjereFoer.join(', ')}, now ${nu.join(', ')})`; } + // R9d (Astra R9-2): et ja til et klik i en adgangskode-side gaelder DEN side - samme proces, samme ramme, samme grund. + // Og et punkt der er blevet en adgangskode-side, klikkes aldrig paa et ja til noget andet. + if (koordinatOpslag && nuKoordinat) { + if (vaultKlik) { + const samme = nuKoordinat.password_page === true && nuKoordinat.pid === koordinatOpslag.pid + && JSON.stringify(nuKoordinat.frame ?? null) === JSON.stringify(koordinatOpslag.frame ?? null) + && nuKoordinat.note === koordinatOpslag.note; + if (!samme) return 'what is under that point changed after the person approved the click in a password manager page (another process, element or reason), so it was not clicked'; + } else if (nuKoordinat.password_page) { + return 'the point is now inside a password manager page, or one that could not be ruled out, which is never clicked by an agent - ask the person to do this step with computer_ask_user'; + } + } } // ⛔ ASTRA 25/9 (Critical): tastatur-input UDEN app lander i det program // der er forrest NAAR det sendes - men blev vurderet paa det der var @@ -2233,7 +2257,7 @@ async function haandterKald(request) { try { igenKlik = await callHelper(['at', '--app', appVaerdi(args, targetBundleId), '--x', String(args.x), '--y', String(args.y)], { timeout: 8000 }); } catch {} if (!igenKlik?.found || igenKlik.window_number !== appKlik.window_number) return 'the window under that point in the app changed while the agent waited'; } - const igen = await sendeDom(name, args, targetBundleId, igenKlik); + const igen = await sendeDom(name, args, targetBundleId, igenKlik, nuKoordinat); if (JSON.stringify(igen ?? null) !== JSON.stringify(sende ?? null)) { // R9: et ja til et klik i en adgangskode-side gaelder kun den side - ikke en besked, og ikke et andet punkt. if (sende?.adgangskodeSide || igen?.adgangskodeSide) return 'what is under that point changed after the person approved the click in a password manager page, so it was not clicked'; diff --git a/test/bundet-maal.mjs b/test/bundet-maal.mjs index 249ddaca..4e9de6dd 100644 --- a/test/bundet-maal.mjs +++ b/test/bundet-maal.mjs @@ -396,8 +396,10 @@ for (const [nr, tekst, args, rolle] of [ await rpc('initialize', { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'bundet', version: '1' } }); const r = await kald('computer_click', { x: 10, y: 20 }); const klik = hj.kald().filter(k => k.argv[0] === 'click'); - check('11a klik uden app: ejeren fundet, men knap-opslaget svarer intet - porten spoerger (og intet klik uden ja)', - klik.length === 0 && spoerger.gangeSpurgt() === 1, `klik ${klik.length} · spurgt ${spoerger.gangeSpurgt()} · ` + r.tekst.slice(0, 120)); + // R9d: ét opslag doemmer nu ejer OG knap (Astra R9-1); det andet opslag er genmaalingen under laasen. Egenskaben er den + // samme som foer: svarer et opslag intet, klikkes der ikke. + check('11a klik uden app: ejeren fundet ved dommen, genmaalingen svarer intet - intet klik', + klik.length === 0 && r.fejl && /could not be confirmed just before acting/.test(r.tekst), `klik ${klik.length} · spurgt ${spoerger.gangeSpurgt()} · ` + r.tekst.slice(0, 120)); srv.kill(); } { @@ -511,29 +513,37 @@ for (const [nr, tekst, args, rolle] of [ udfald.every(u => u.ok), JSON.stringify(udfald.filter(u => !u.ok))); } -// 12f-12h · R8 (Astra, MAALT): uden app slaar sende-dommen og knapErFarlig punktet op hver for sig. Saa sende-dommen -// «vault» (og svarede null) og det naeste opslag «en OK-knap», blev der klikket uden spoergsmaal. Raekkefoelgen -// af opslag: ejer, sende-dom, farlig-knap-dom, ejer-genmaaling, ny sende-dom (Astras fem). +// 12f-12k · R8/R9 (Astra, MAALT): et klik uden app blev doemt af flere opslag hver for sig - «vault» i ét og «OK-knap» i et +// andet gav et klik uden ja, ogsaa i browsere uden for beskedlisten (Chrome Beta, Firefox Nightly). Nu doemmer ÉT +// opslag (ejeren) alt, og genmaalingen under laasen binder ja'et til samme proces, ramme og grund. +// Raekkefoelgen af `at`: [0] ejer/dom, [1] genmaaling under laasen. { - const V = { found: true, app: 'Google Chrome', bundleId: 'com.google.Chrome', pid: 400, role: '', title: '', description: '', window: '', password_page: true, note: 'The point is inside a password manager page; nothing from it is returned.', under: ['com.google.Chrome'] }; + const V = { found: true, app: 'Google Chrome', bundleId: 'com.google.Chrome', pid: 400, role: '', title: '', description: '', window: '', password_page: true, note: 'The point is inside a password manager page; nothing from it is returned.', frame: { x: 0, y: 0, w: 300, h: 40 }, under: ['com.google.Chrome'] }; const O = { ...V, role: 'AXButton', title: 'OK', window: 'Normal', password_page: false, note: '' }; - const APPS = { apps: [{ name: 'Google Chrome', bundleId: 'com.google.Chrome', pid: 400, active: false }, - { name: 'Finder', bundleId: 'com.apple.finder', pid: 300, active: true }] }; - for (const [id, hvad, raekke, svar, skalKlikke, skalSpoerge] of [ - ['12f', 'vault, vault, OK-knap, vault, vault - personen svarer ikke: spurgt, intet klik', [V, V, O, V, V], 'udloeb', false, true], - ['12g', 'personen siger ja, men genkontrollen ser ikke laengere vault: intet klik', [V, V, O, V, O], 'ja', false, true], - ['12h', 'kalibrering: personen siger ja, punktet er stadig vault: klikket sendes', [V, V, V, V, V], 'ja', true, true], + const app = (bid, navn) => ({ apps: [{ name: navn, bundleId: bid, pid: 400, active: false }, { name: 'Finder', bundleId: 'com.apple.finder', pid: 300, active: true }] }); + const som = (o, bid) => ({ ...o, bundleId: bid, under: [bid] }); + const CH = 'com.google.Chrome', BETA = 'com.google.Chrome.beta', NIGHT = 'org.mozilla.nightly', NOTES = 'com.apple.Notes'; + for (const [id, hvad, bid, navn, raekke, svar, skalKlikke, skalSpoerge, vaultTekst] of [ + ['12f', 'vault ved dommen, personen svarer ikke: spurgt, intet klik', CH, 'Google Chrome', [V, V], 'udloeb', false, true, true], + ['12g', 'ja, men genmaalingen ser ikke laengere vault: intet klik', CH, 'Google Chrome', [V, O], 'ja', false, true, true], + ['12h', 'kalibrering: ja, punktet er stadig samme vault: klikket sendes', CH, 'Google Chrome', [V, V], 'ja', true, true, true], + ['12i', 'Chrome Beta (ikke paa beskedlisten): vault kraever ja - Astras R9-sekvens', BETA, 'Google Chrome Beta', [som(V, BETA), som(O, BETA), som(V, BETA)], 'udloeb', false, true, true], + ['12i2', 'Firefox Nightly (ikke paa beskedlisten): vault kraever ja', NIGHT, 'Firefox Nightly', [som(V, NIGHT), som(O, NIGHT), som(V, NIGHT)], 'udloeb', false, true, true], + ['12j', 'ja, men samme vault i en ANDEN proces: intet klik', CH, 'Google Chrome', [V, { ...V, pid: 401 }], 'ja', false, true, true], + ['12j2', 'ja, men et ANDET element i vaulten (ny ramme): intet klik', CH, 'Google Chrome', [V, { ...V, frame: { x: 0, y: 60, w: 300, h: 40 } }], 'ja', false, true, true], + ['12k', 'et almindeligt punkt (Notes) bliver en vault under ventetiden: intet klik', NOTES, 'Notes', [som(O, NOTES), som(V, NOTES)], 'ja', false, false, false], ]) { const sp = lavFalskSpoerger(svar, 'cmcp-bundet-vault'); - const { srv, rpc, kald, hj } = klient({ apps: APPS, at: { _raekke: raekke }, samtale: { window: 'Vault' } }, { CMCP_BACKGROUND: '0', CMCP_OSASCRIPT: sp.sti }); + const { srv, rpc, kald, hj } = klient({ apps: app(bid, navn), at: { _raekke: raekke }, samtale: { window: 'Vault' } }, { CMCP_BACKGROUND: '0', CMCP_OSASCRIPT: sp.sti }); await rpc('initialize', { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'bundet', version: '1' } }); const r = await kald('computer_click', { x: 10, y: 20 }); const klik = hj.kald().filter(k => k.argv[0] === 'click'); - check(`${id} klik uden app paa en vault-side: ${hvad}`, - klik.length === (skalKlikke ? 1 : 0) && (sp.gangeSpurgt() >= 1) === skalSpoerge + const spurgt = sp.gangeSpurgt() >= 1; + check(`${id} klik uden app: ${hvad}`, + klik.length === (skalKlikke ? 1 : 0) && (skalSpoerge ? spurgt : true) // R8 (Opus O4): personen skal kunne se, at et ja klikker INDE i en adgangskode-side - && sp.tekster().some(x => /password manager page/.test(x)), - `klik ${klik.length} · spurgt ${sp.gangeSpurgt()} · spoergsmaal ${JSON.stringify(sp.tekster().map(x => x.slice(0, 90)))} · ` + r.tekst.slice(0, 140)); + && (!vaultTekst || sp.tekster().some(x => /password manager page/.test(x))), + `klik ${klik.length} · spurgt ${sp.gangeSpurgt()} · spoergsmaal ${JSON.stringify(sp.tekster().map(x => x.slice(0, 80)))} · ` + r.tekst.slice(0, 160)); srv.kill(); } } diff --git a/test/chrome-start.mjs b/test/chrome-start.mjs index e151e09e..1eca9728 100644 --- a/test/chrome-start.mjs +++ b/test/chrome-start.mjs @@ -49,11 +49,12 @@ export async function startChrome(args) { try { pid = Number(execFileSync('/usr/bin/pgrep', ['-o', '-f', moenster], { encoding: 'utf8' }).trim().split('\n')[0]) || 0; } catch { /* ikke startet endnu */ } } const stop = () => { - try { execFileSync('/usr/bin/pkill', ['-f', moenster]); } catch { /* allerede vaek */ } + // R9 (Astra): ogsaa oprydningens proceskald har en frist (5 s); et tidsudloeb maaler intet og taeller ikke som lukket. + try { execFileSync('/usr/bin/pkill', ['-f', moenster], { timeout: 5000 }); } catch { /* allerede vaek, eller fejl - maales nedenfor */ } // Maal at den er vaek - en oprydning der ikke virker, var hele fejlen 08.2x. // R8 (Astra, MAALT): enhver pgrep-fejl talte som «lukket». Kun status 1 betyder «ingen tilbage»; en fejl (2, 3) maaler intet. - for (let i = 0; i < 20; i++) { try { execFileSync('/usr/bin/pgrep', ['-f', moenster]); } catch (e) { if (e.status === 1) return true; } execFileSync('/bin/sleep', ['0.25']); } - try { execFileSync('/usr/bin/pkill', ['-9', '-f', moenster]); } catch { /* vaek */ } + for (let i = 0; i < 20; i++) { try { execFileSync('/usr/bin/pgrep', ['-f', moenster], { timeout: 5000 }); } catch (e) { if (e.status === 1) return true; } execFileSync('/bin/sleep', ['0.25']); } + try { execFileSync('/usr/bin/pkill', ['-9', '-f', moenster], { timeout: 5000 }); } catch { /* vaek */ } return false; }; // ASN, ikke navn: personens eget Chrome og test-Chrome hedder begge «Google Chrome». From d3c31fd14b19b5669476cbcd846b388e2a8d28d5 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Thu, 5 Nov 2026 13:38:21 +0100 Subject: [PATCH 61/94] R10 efter Astra R10 (IKKE GODKENDT): et klik uden app i en adgangskode-side afvises, som med app - intet blindt ja at binde - index.js: et klik uden app i en password_page (genkendt eller ikke udelukket) afvises paa ejer-opslaget, foer sende-dommen; ingen spoerges. Maerket i sende-dommen, bindingen (pid/ramme/note), den saerlige spoergetekst og aldrigViaIkonet-grenen er fjernet (kunne ikke naas). Fire runder maalte, at et ja til et blindt klik ikke kunne bindes til siden. - bundet-maal 12d-12l: genkendt vault, R8-sekvensen, Beta, Nightly, alle seks ikke-udelukkede grunde (12e1-12e6), almindeligt -> vault (12k), kalibrering: almindeligt klik i Chrome gaar igennem (12l). Mutant (afvisningen slaaet fra): 10 roede. - claims-offline: notens kontrakt foelger til afvisningen - flader (README, CHANGELOG, llms, security, serverinstruktionen): et klik der afvises, med eller uden app, ingen spoerges - hjaelperen uaendret: kandidaten 88866507 gaelder Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 21 ++++----- README.md | 5 +- docs/llms.txt | 2 +- docs/security.html | 2 +- mcp-server/README.md | 5 +- mcp-server/index.js | 56 ++++++++-------------- test/bundet-maal.mjs | 102 ++++++++++++---------------------------- test/claims-offline.mjs | 2 +- 8 files changed, 67 insertions(+), 128 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 4ec40822..1fed0c07 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -57,17 +57,14 @@ in Chrome and Edge - each id checked against Chrome Web Store or Edge Add-ons on is never returned by `computer_find`, `computer_inspect`, `computer_focused` or the click gate's lookup (the answer says what was left out), its window is blacked out whole in screenshots, typing (also the direct accessibility route) is refused, and a click is -refused (without an app named, which needs foreground mode, it asks every time - the send -gate no longer mistakes such a page, with its empty title, for a chat: `test/bundet-maal.mjs` -12d; a page that could not be checked might be a web chat, and keeps the send gate - every -such reason the helper gives: 12e). A click without an -app is judged by ONE lookup of the point (its owner, the send gate and the dangerous-click rule all use it), so a -second lookup that happens to see an ordinary button cannot turn it into a click that is not asked - in any browser, -not only those the send gate knows (`test/bundet-maal.mjs` 12f-12i2, the reviews' sequences, Chrome Beta and Firefox -Nightly included). A point inside such a page always asks, the yes cannot come from the menu bar, as for password -manager apps, and the question says the point is inside a password manager page. The yes covers that page only: the -lookup just before the click must show the same process, element frame and reason (12j, 12j2), and a point that -became such a page while an ordinary click waited is not clicked (12k). A web page whose address cannot be read - in any app, since the address rule applies +refused - with or without an app named, and also when the page could not be ruled out, and +nobody is asked. Four review rounds measured why asking was not enough: a yes to a blind click +could not be tied to the page (a second lookup could see an ordinary button; process, frame and +reason survive a navigation), and browsers outside the send gate's list clicked after a yes. A +click without an app is judged by ONE lookup of the point, in every browser (`test/bundet-maal.mjs` +12d, 12f, 12i, 12i2, and 12e1-12e6 for every reason a page could not be ruled out; 12l checks that +an ordinary click in Chrome still goes through; switching the refusal off turns ten of them red), +and a point that became such a page while an ordinary click waited is not clicked (12k). A web page whose address cannot be read - in any app, since the address rule applies to web areas everywhere - or an element whose role cannot be read in a browser counts as one that cannot be ruled out. `version` lists `browser-password-pages`; `vault-url --url` answers the address rule on its @@ -93,7 +90,7 @@ capture and scan. It is a guard against accidents, not a fence: non-text keys, developer tools and the clipboard are not covered. Test: `test/chrome-vault-live.mjs` against a real vault address (`https://vault.bitwarden.com`, served locally over HTTPS and pointed at with `--host-resolver-rules`; Chrome does not open its own password page from the command line). Every whole-window and skipped-page reason tied to an app now carries the process it came from (`Google Chrome [pid 4321] (...)`, and `pid` on inspect's denied password-page node), because two Chrome processes share one name: the test requires each signal to come from its own Chrome process and matches the vault reason's exact wording (not the "role could not be read" reason); a check before and after, which an unreadable window elsewhere could fool, was dropped. `test/chrome-dyb-side-live.mjs` binds its depth reason the same way. After the third review (R7-R9, 5 Nov): `computer_press`, `computer_set_value` and -`computer_wait_for` say when they skipped a password manager page (`skipped_password_pages`) +`computer_wait_for` say when they skipped a password manager page and then found nothing or ran out of time (`skipped_password_pages`) instead of only "nothing matched", so an agent does not keep searching (`test/chrome-vault-live.mjs` 4-5); a write into a focus inside such a page says what it is rather than "a secure field"; a host written with a final dot (`vault.bitwarden.com.`) and doubled slashes in the path are the diff --git a/README.md b/README.md index 0aed3589..660724a7 100644 --- a/README.md +++ b/README.md @@ -537,8 +537,9 @@ sit unnoticed until it expires. That is a real limitation today, not a setting. skipped one and then found nothing or ran out of time, instead of only "nothing matched"), its window is blacked out whole in screenshots, typing there is refused, and a click - there is refused (or, without an app named, which needs foreground mode, asks - every time) - like password manager apps. The address rule applies to a web page + there is refused - with or without an app named, also a page that could not be + ruled out, and nobody is asked (a yes to a blind click could not be tied to the + page). The address rule applies to a web page in any app, not only in a browser. A web page whose address cannot be read (in any app), or an element whose role cannot be read in a browser, is kept out of the reading tools too - that can also leave out ordinary content, and then a search diff --git a/docs/llms.txt b/docs/llms.txt index 58147ac3..18518c35 100644 --- a/docs/llms.txt +++ b/docs/llms.txt @@ -117,7 +117,7 @@ under a friendlier name. a suggestion menu in another page) are never returned by find, inspect or focused (press, set_value and wait_for say when they skipped one and found nothing), their window is blacked out whole, typing there is refused, and a click there is - refused or asks every time, like password manager apps. The address rule applies to + refused, with or without an app named (nobody is asked). The address rule applies to a web page in any app; a page whose address, or a browser element whose role, cannot be read is left out too (a search then says it was incomplete). A guard against accidents, not a fence: Chrome's own password bubbles and autofill rows, non-text keys, diff --git a/docs/security.html b/docs/security.html index a40b1ae1..4c19236f 100644 --- a/docs/security.html +++ b/docs/security.html @@ -199,7 +199,7 @@

Gate 1 - redaction happens before the file exists

Had we written the file first and redacted after, there would be a window - short, but real - where an unredacted picture of your desktop sat on disk for any other process to read. A security property with a race in it is not a security property.

Two things get painted:

    -
  • Secure text fields. Native fields expose the role AXSecureTextField. Fields in a web page expose the role AXTextField with the subrole AXSecureTextField. Checking only the role catches native fields and lets every browser password box through - which is the case that actually matters. We check both. A field in a web page is only visible once the browser shows its page to the accessibility layer: in Chrome this server switches that on (the switch a screen reader uses), and while a Chrome window's page is not readable yet - still being built, 3 to 15 seconds after it is first switched on, measured on Chrome 156, or empty - the whole window is painted over instead. Not covered: Safari, Firefox, Chromium browsers we do not name, Chrome app windows, and any browser when CMCP_INGEN_ELECTRON=1 is set. Known gaps, not measured: a field in a cross-site frame, or a login step that appears before Chrome has updated its tree. Password managers inside a browser are treated like native ones: a page whose address is the browser's own password page, a known web vault or one of eighteen known password-manager extensions in Chrome and Edge (also as a suggestion menu inside another page) is never returned by the reading tools (and the acting tools say when they skipped one and found nothing), its window is blacked out whole, typing there is refused, and a click there is refused (or, without an app named, which needs foreground mode, asks every time) - like password manager apps. The address rule applies to a web page in any app, not only a browser; a page whose address, or a browser element whose role, cannot be read is kept out of the reading tools too, and a search then says it was incomplete. Not recognised: a self-hosted vault, an unlisted extension, Safari's and Firefox's extension pages. Not hidden: window and menu titles (as for native apps), screen recordings, and Chrome's own password bubbles and autofill rows, which are native panels rather than pages. It is a guard against accidents, not a fence: keys that are not text, developer tools and the clipboard are not covered.
    • +
  • Secure text fields. Native fields expose the role AXSecureTextField. Fields in a web page expose the role AXTextField with the subrole AXSecureTextField. Checking only the role catches native fields and lets every browser password box through - which is the case that actually matters. We check both. A field in a web page is only visible once the browser shows its page to the accessibility layer: in Chrome this server switches that on (the switch a screen reader uses), and while a Chrome window's page is not readable yet - still being built, 3 to 15 seconds after it is first switched on, measured on Chrome 156, or empty - the whole window is painted over instead. Not covered: Safari, Firefox, Chromium browsers we do not name, Chrome app windows, and any browser when CMCP_INGEN_ELECTRON=1 is set. Known gaps, not measured: a field in a cross-site frame, or a login step that appears before Chrome has updated its tree. Password managers inside a browser are treated like native ones: a page whose address is the browser's own password page, a known web vault or one of eighteen known password-manager extensions in Chrome and Edge (also as a suggestion menu inside another page) is never returned by the reading tools (and the acting tools say when they skipped one and found nothing), its window is blacked out whole, typing there is refused, and a click there is refused - with or without an app named, also when the page could not be ruled out, and nobody is asked. The address rule applies to a web page in any app, not only a browser; a page whose address, or a browser element whose role, cannot be read is kept out of the reading tools too, and a search then says it was incomplete. Not recognised: a self-hosted vault, an unlisted extension, Safari's and Firefox's extension pages. Not hidden: window and menu titles (as for native apps), screen recordings, and Chrome's own password bubbles and autofill rows, which are native panels rather than pages. It is a guard against accidents, not a fence: keys that are not text, developer tools and the clipboard are not covered.
  • Whole windows of listed apps. Keychain Access, 1Password, Bitwarden, LastPass, Dashlane, Apple Passwords. We do not walk into those windows to decide what to hide; descending into a vault to work out what is secret is the mistake we are avoiding.

The rectangles are painted solid black, not blurred or pixelated. A good enough model can read through pixelation. It cannot read through black.

diff --git a/mcp-server/README.md b/mcp-server/README.md index 75e08176..c55aaeed 100644 --- a/mcp-server/README.md +++ b/mcp-server/README.md @@ -535,8 +535,9 @@ sit unnoticed until it expires. That is a real limitation today, not a setting. skipped one and then found nothing or ran out of time, instead of only "nothing matched"), its window is blacked out whole in screenshots, typing there is refused, and a click - there is refused (or, without an app named, which needs foreground mode, asks - every time) - like password manager apps. The address rule applies to a web page + there is refused - with or without an app named, also a page that could not be + ruled out, and nobody is asked (a yes to a blind click could not be tied to the + page). The address rule applies to a web page in any app, not only in a browser. A web page whose address cannot be read (in any app), or an element whose role cannot be read in a browser, is kept out of the reading tools too - that can also leave out ordinary content, and then a search diff --git a/mcp-server/index.js b/mcp-server/index.js index 0deb16c2..88273d7e 100644 --- a/mcp-server/index.js +++ b/mcp-server/index.js @@ -274,7 +274,7 @@ so (\`tree_building\`), and until it is built, that Chrome window is blacked out whole in screenshots. Read again before you conclude a page is empty. Password managers inside a browser (the browser's own password page, a known web vault or password-manager extension) are never returned, typing there is refused, and a click -there is refused (named app) or needs the person (no app named), like the native apps: +there is refused, with or without an app named, and nobody is asked: an answer that says skipped_password_pages, password_page or denied left one out on purpose - do not try to read or click it another way; ask the person instead. When a browser tool is also in this session (Browser MCP's browser_*), let it do @@ -713,10 +713,7 @@ async function sendeDom(name, args, bid, appKlik = null, forhaand = null) { } else if (name === 'computer_click') { const d = appKlik || forhaand || await callHelper(['at', '--x', String(args.x), '--y', String(args.y)], { timeout: 8000 }); kontrolSvar = { navne: [d.title, d.description], rolle: d.role, vindue: d.window || null, ramme: d.frame || null, - fundet: !!d.found, andetProgram: d.bundleId !== bid, - // KUN en genkendt adgangskode-side (hjaelperens note, main.swift `at`). En side hvis adresse ikke - // kunne laeses, er ogsaa password_page (fejl-lukket) - den kan vaere en webchat, og beholder sende-dommen. - adgangskodeSide: d.password_page === true && /^The point is inside a password manager page;/.test(String(d.note || '')) }; + fundet: !!d.found, andetProgram: d.bundleId !== bid }; } else kontrolSvar = null; } catch { kontrolSvar = { fejl: true }; } return kontrolSvar; @@ -727,15 +724,7 @@ async function sendeDom(name, args, bid, appKlik = null, forhaand = null) { if (slags === 'browser') { const t = await callHelper(['samtale', '--app', appVaerdi(args, bid), '--title-only'], { timeout: 8000 }).catch(() => ({})); const k = await kontrol(); - // ⛔ R7 (Astra + Opus, MAALT i test/bundet-maal.mjs 12d): et punkt i en GENKENDT adgangskode-side har tom titel og tomt - // vindue (hjaelperen udleverer intet derfra), og blev her doemt som en chat - et haardt Send-afslag uden mening. Siden - // er ingen besked; knapErFarlig doemmer den farlig, saa personen spoerges, som ved et adgangskode-program. En side - // der ikke kunne afgoeres (12e), doemmes stadig her, fejl-lukket. - // ⛔ R8 (Astra, MAALT med fem opslag): `null` her gjorde klikket til et almindeligt klik, og knapErFarlig slaar - // punktet op IGEN. Svarede det andet opslag «en OK-knap», blev der klikket i en vault uden spoergsmaal. Nu er - // svaret et maerke: det tvinger et ja (alwaysAsk, aldrig via menulinjen - som et adgangskode-program), og - // genkontrollen under laasen kraever samme maerke (12f-12g). - if (k?.adgangskodeSide) return { adgangskodeSide: true }; + // R7-R10: et klik i en adgangskode-side naar ikke hertil - det afvises foer sende-dommen (med og uden app). // Runde 5 (Astra 2, Fable 1): en kontrol hvis vindue ikke kan laeses, er et ukendt // vindue - det doemmes som den fokuserede titel doemmes: fejl-lukket, som en chat. const titler = [String(t.window || '').trim(), ...(k ? [k.fejl ? '' : String(k.vindue || '').trim()] : [])]; @@ -2044,11 +2033,18 @@ async function haandterKald(request) { } args[KLIK_VINDUE] = appKlik.window_number; } + // ⛔ R10 (Astra R8-R10, MAALT): et ja til et BLINDT klik i en adgangskode-side kunne ikke bindes til siden - pid, ramme og + // note overlever en navigation eller et nyt element paa samme plads, og hjaelperen udleverer (med vilje) intet om siden. + // Saa et klik uden app i en adgangskode-side - genkendt eller ikke udelukket - afvises nu, som et klik MED app: ingen + // spoerges, intet klikkes, og personen tager trinnet selv. Doemt paa ét opslag (ejeren), i alle browsere. + if (name === 'computer_click' && !args.app && koordinatOpslag?.password_page === true) { + const kendt = /^The point is inside a password manager page;/.test(String(koordinatOpslag.note || '')); + record({ tool: name, tier: tool.tier, args: scrubArgs(args), mode: currentMode(), target: targetBundleId, + decision: 'denied', asked: false, reason: `click: the point is inside ${kendt ? 'a password manager page' : 'a page that could not be ruled out as one'}` }); + return errorResult(`Refused: that point is inside ${kendt ? 'a password manager page' : 'a page that could not be ruled out as a password manager page'} (${koordinatOpslag.app || targetBundleId || 'a browser'}). ` + + `Like password manager apps, it is never clicked by an agent. Nothing was done, and nobody was asked; ask the person to do this step with computer_ask_user.`); + } const sende = (effektivTier === TIER.READ || kunLaes) ? null : await sendeDom(name, args, targetBundleId, appKlik, koordinatOpslag); - // Et klik uden app i en adgangskode-side - genkendt eller ikke udelukket - kraever ALTID et ja, aldrig via menulinjen, - // uanset om browseren staar paa beskedlisten (R9d, Astra R9-1: Chrome Beta og Firefox Nightly klikkede uden ja). - const vaultKlik = name === 'computer_click' && !args.app && koordinatOpslag?.password_page === true; - const kendtVaultKlik = vaultKlik && /^The point is inside a password manager page;/.test(String(koordinatOpslag.note || '')); if (sende?.afvis) { record({ tool: name, tier: tool.tier, args: scrubArgs(args), mode: currentMode(), target: targetBundleId, decision: 'denied', asked: false, reason: `send port: ${sende.afvis}` }); @@ -2080,7 +2076,7 @@ async function haandterKald(request) { // («Type 11 characters»). Status og koe beholder den korte tekst. tier: effektivTier, targetBundleId, describe: sende?.describe || describe(name, args), ikon: { session: SESSION, client: server.getClientVersion?.()?.name || process.env.CMCP_CLIENT || null }, - aldrigViaIkonet: usloeretBillede || sende?.adgangskodeSide === true || vaultKlik, + aldrigViaIkonet: usloeretBillede, // Et menupunkt der ser ud til at slette noget, spoerger hver gang - // ogsaa i allow, som et farligt program. // At lukke et vindue kan tabe ugemt arbejde. Flytte og aendre kan ikke. @@ -2096,10 +2092,8 @@ async function haandterKald(request) { || name === 'computer_space' || usloeretBillede || optagStart - || !!sende || vaultKlik, - hvorfor: (sende?.adgangskodeSide || kendtVaultKlik) ? 'That point is inside a password manager page. Like a password manager app, it is never clicked by an agent without your yes. This yes covers this one click only.' - : vaultKlik ? 'That point is inside a page that could not be ruled out as a password manager page, so it is never clicked by an agent without your yes. This yes covers this one click only.' - : sende ? 'A message to a real person cannot be taken back. This yes covers this one message only.' + || !!sende, + hvorfor: sende ? 'A message to a real person cannot be taken back. This yes covers this one message only.' : hvorforSpoerg(name, args, { usloeretBillede, optagStart }) }); @@ -2207,17 +2201,9 @@ async function haandterKald(request) { } else if (somMaengde(nu) !== somMaengde(koordinatEjereFoer)) { return `the window under that point changed while the agent waited (was ${koordinatEjereFoer.join(', ')}, now ${nu.join(', ')})`; } - // R9d (Astra R9-2): et ja til et klik i en adgangskode-side gaelder DEN side - samme proces, samme ramme, samme grund. - // Og et punkt der er blevet en adgangskode-side, klikkes aldrig paa et ja til noget andet. - if (koordinatOpslag && nuKoordinat) { - if (vaultKlik) { - const samme = nuKoordinat.password_page === true && nuKoordinat.pid === koordinatOpslag.pid - && JSON.stringify(nuKoordinat.frame ?? null) === JSON.stringify(koordinatOpslag.frame ?? null) - && nuKoordinat.note === koordinatOpslag.note; - if (!samme) return 'what is under that point changed after the person approved the click in a password manager page (another process, element or reason), so it was not clicked'; - } else if (nuKoordinat.password_page) { - return 'the point is now inside a password manager page, or one that could not be ruled out, which is never clicked by an agent - ask the person to do this step with computer_ask_user'; - } + // R9d/R10: et punkt der er blevet en adgangskode-side, mens der blev ventet, klikkes aldrig paa et ja til noget andet. + if (koordinatOpslag && nuKoordinat?.password_page) { + return 'the point is now inside a password manager page, or one that could not be ruled out, which is never clicked by an agent - ask the person to do this step with computer_ask_user'; } } // ⛔ ASTRA 25/9 (Critical): tastatur-input UDEN app lander i det program @@ -2259,8 +2245,6 @@ async function haandterKald(request) { } const igen = await sendeDom(name, args, targetBundleId, igenKlik, nuKoordinat); if (JSON.stringify(igen ?? null) !== JSON.stringify(sende ?? null)) { - // R9: et ja til et klik i en adgangskode-side gaelder kun den side - ikke en besked, og ikke et andet punkt. - if (sende?.adgangskodeSide || igen?.adgangskodeSide) return 'what is under that point changed after the person approved the click in a password manager page, so it was not clicked'; return 'what would be sent changed after the person approved it - who it goes to or what it says - so it was not sent'; } } diff --git a/test/bundet-maal.mjs b/test/bundet-maal.mjs index 4e9de6dd..daf4f7df 100644 --- a/test/bundet-maal.mjs +++ b/test/bundet-maal.mjs @@ -466,84 +466,40 @@ for (const [nr, tekst, args, rolle] of [ srv.kill(); } } -// 12d · R6/R7 (Astra + Opus): et klik UDEN app paa en adgangskode-side i Chrome skal spoerge personen, som et -// adgangskode-program. Siden har tom titel og tomt vindue, og sende-dommen tog den for en chat og afviste -// haardt med en Send-tekst, der intet havde med sagen at goere. Forgrund, saa spoergsmaalet kan taelles. +// 12d-12l · R6-R10 (Astra + Opus, MAALT over fire runder): et klik UDEN app i en adgangskode-side - genkendt eller ikke +// udelukket - afvises nu, som et klik med app. Et ja til et blindt klik kunne ikke bindes til siden (pid, ramme og +// note overlever en navigation), saa ingen spoerges. Doemt paa ét opslag (ejeren) i alle browsere. Forgrund, og +// personen ville sige ja - det maa ikke hjaelpe. Raekkefoelgen af `at`: [0] ejer/dom, [1] genmaaling under laasen. { - // Noten i hjaelperens ordlyd (main.swift `at`): «The point is inside ; nothing from it is returned.» - const VAULT = { found: true, app: 'Google Chrome', bundleId: 'com.google.Chrome', pid: 400, role: '', title: '', description: '', window: '', password_page: true, note: 'The point is inside a password manager page; nothing from it is returned.', under: ['com.google.Chrome'] }; - const { srv, rpc, kald, hj, spoerger } = klient({ - apps: { apps: [{ name: 'Google Chrome', bundleId: 'com.google.Chrome', pid: 400, active: false }, - { name: 'Finder', bundleId: 'com.apple.finder', pid: 300, active: true }] }, - at: VAULT, samtale: { window: 'Vault' } }, { CMCP_BACKGROUND: '0' }); - await rpc('initialize', { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'bundet', version: '1' } }); - const r = await kald('computer_click', { x: 10, y: 20 }); - const klik = hj.kald().filter(k => k.argv[0] === 'click'); - check('12d klik uden app paa en adgangskode-side i Chrome: personen spoerges, intet Send-afslag, intet klik uden ja', - klik.length === 0 && spoerger.gangeSpurgt() === 1 && !/Send control|Nothing was sent|was not sent/.test(r.tekst), - `klik ${klik.length} · spurgt ${spoerger.gangeSpurgt()} · ` + r.tekst.slice(0, 200)); - srv.kill(); -} - -// 12e · Modstykket: en side der IKKE er genkendt som vault, men heller ikke kunne udelukkes, er ogsaa password_page -// (fejl-lukket) - og den kan vaere en webchat. Den maa ikke slippe uden om sende-dommen og blive et almindeligt -// «farligt klik», hvor personen godkender uden at se modtager og tekst. R8 (Opus O5): ALLE hjaelperens grunde af -// den slags (iVaultSide/vaultGrund i Accessibility.swift), ikke kun én - et udvidet moenster skal blive roedt her. -{ - const GRUNDE = ['a page whose address could not be read, so it could not be ruled out as a password manager', - 'a page that looks like a password manager (it has no address)', - 'an element whose app and page could not be checked', - 'an element whose app could not be identified, so its page could not be checked', - 'an element in a browser whose page could not be checked', - 'a browser element whose role could not be read, so it could not be ruled out as a password manager page']; - const udfald = []; - for (const g of GRUNDE) { - const UKENDT = { found: true, app: 'Google Chrome', bundleId: 'com.google.Chrome', pid: 400, role: '', title: '', description: '', window: '', password_page: true, note: `The point is inside ${g}; nothing from it is returned.`, under: ['com.google.Chrome'] }; - const { srv, rpc, kald, hj, spoerger } = klient({ - apps: { apps: [{ name: 'Google Chrome', bundleId: 'com.google.Chrome', pid: 400, active: false }, - { name: 'Finder', bundleId: 'com.apple.finder', pid: 300, active: true }] }, - at: UKENDT, samtale: { window: 'WhatsApp' } }, { CMCP_BACKGROUND: '0' }); - await rpc('initialize', { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'bundet', version: '1' } }); - const r = await kald('computer_click', { x: 10, y: 20 }); - const klik = hj.kald().filter(k => k.argv[0] === 'click'); - udfald.push({ g: g.slice(0, 40), ok: klik.length === 0 && spoerger.gangeSpurgt() === 0 && r.fejl && /Send control|Nothing was sent/.test(r.tekst), klik: klik.length, spurgt: spoerger.gangeSpurgt() }); - srv.kill(); - } - check(`12e alle ${GRUNDE.length} grunde der ikke er en genkendt vault (maaske en webchat): sende-dommen afviser stadig, ingen spurgt, intet klik`, - udfald.every(u => u.ok), JSON.stringify(udfald.filter(u => !u.ok))); -} - -// 12f-12k · R8/R9 (Astra, MAALT): et klik uden app blev doemt af flere opslag hver for sig - «vault» i ét og «OK-knap» i et -// andet gav et klik uden ja, ogsaa i browsere uden for beskedlisten (Chrome Beta, Firefox Nightly). Nu doemmer ÉT -// opslag (ejeren) alt, og genmaalingen under laasen binder ja'et til samme proces, ramme og grund. -// Raekkefoelgen af `at`: [0] ejer/dom, [1] genmaaling under laasen. -{ - const V = { found: true, app: 'Google Chrome', bundleId: 'com.google.Chrome', pid: 400, role: '', title: '', description: '', window: '', password_page: true, note: 'The point is inside a password manager page; nothing from it is returned.', frame: { x: 0, y: 0, w: 300, h: 40 }, under: ['com.google.Chrome'] }; - const O = { ...V, role: 'AXButton', title: 'OK', window: 'Normal', password_page: false, note: '' }; + const NOTE = (g) => `The point is inside ${g}; nothing from it is returned.`; + const V = { found: true, app: 'Google Chrome', bundleId: 'com.google.Chrome', pid: 400, role: '', title: '', description: '', window: '', password_page: true, note: NOTE('a password manager page'), frame: { x: 0, y: 0, w: 300, h: 40 }, under: ['com.google.Chrome'] }; + const O = { ...V, role: 'AXButton', title: 'OK', window: 'Dokument', password_page: false, note: '' }; const app = (bid, navn) => ({ apps: [{ name: navn, bundleId: bid, pid: 400, active: false }, { name: 'Finder', bundleId: 'com.apple.finder', pid: 300, active: true }] }); - const som = (o, bid) => ({ ...o, bundleId: bid, under: [bid] }); - const CH = 'com.google.Chrome', BETA = 'com.google.Chrome.beta', NIGHT = 'org.mozilla.nightly', NOTES = 'com.apple.Notes'; - for (const [id, hvad, bid, navn, raekke, svar, skalKlikke, skalSpoerge, vaultTekst] of [ - ['12f', 'vault ved dommen, personen svarer ikke: spurgt, intet klik', CH, 'Google Chrome', [V, V], 'udloeb', false, true, true], - ['12g', 'ja, men genmaalingen ser ikke laengere vault: intet klik', CH, 'Google Chrome', [V, O], 'ja', false, true, true], - ['12h', 'kalibrering: ja, punktet er stadig samme vault: klikket sendes', CH, 'Google Chrome', [V, V], 'ja', true, true, true], - ['12i', 'Chrome Beta (ikke paa beskedlisten): vault kraever ja - Astras R9-sekvens', BETA, 'Google Chrome Beta', [som(V, BETA), som(O, BETA), som(V, BETA)], 'udloeb', false, true, true], - ['12i2', 'Firefox Nightly (ikke paa beskedlisten): vault kraever ja', NIGHT, 'Firefox Nightly', [som(V, NIGHT), som(O, NIGHT), som(V, NIGHT)], 'udloeb', false, true, true], - ['12j', 'ja, men samme vault i en ANDEN proces: intet klik', CH, 'Google Chrome', [V, { ...V, pid: 401 }], 'ja', false, true, true], - ['12j2', 'ja, men et ANDET element i vaulten (ny ramme): intet klik', CH, 'Google Chrome', [V, { ...V, frame: { x: 0, y: 60, w: 300, h: 40 } }], 'ja', false, true, true], - ['12k', 'et almindeligt punkt (Notes) bliver en vault under ventetiden: intet klik', NOTES, 'Notes', [som(O, NOTES), som(V, NOTES)], 'ja', false, false, false], - ]) { - const sp = lavFalskSpoerger(svar, 'cmcp-bundet-vault'); - const { srv, rpc, kald, hj } = klient({ apps: app(bid, navn), at: { _raekke: raekke }, samtale: { window: 'Vault' } }, { CMCP_BACKGROUND: '0', CMCP_OSASCRIPT: sp.sti }); + const som = (o, bid, navn) => ({ ...o, bundleId: bid, app: navn, under: [bid] }); + const UAFGJORTE = ['a page whose address could not be read, so it could not be ruled out as a password manager', + 'a page that looks like a password manager (it has no address)', + 'an element whose app and page could not be checked', + 'an element whose app could not be identified, so its page could not be checked', + 'an element in a browser whose page could not be checked', + 'a browser element whose role could not be read, so it could not be ruled out as a password manager page']; + const tilfaelde = [ + ['12d', 'genkendt vault i Chrome: afvist, ingen spurgt', 'com.google.Chrome', 'Google Chrome', [V, V], 'Vault', /never clicked by an agent/, false], + ['12f', 'genkendt vault, et senere opslag ville se en OK-knap (R8-sekvensen): afvist paa dommen', 'com.google.Chrome', 'Google Chrome', [V, O, V], 'Vault', /never clicked by an agent/, false], + ['12i', 'Chrome Beta (uden for beskedlisten): afvist', 'com.google.Chrome.beta', 'Google Chrome Beta', [som(V, 'com.google.Chrome.beta', 'Google Chrome Beta'), som(O, 'com.google.Chrome.beta', 'Google Chrome Beta')], 'Vault', /never clicked by an agent/, false], + ['12i2', 'Firefox Nightly (uden for beskedlisten): afvist', 'org.mozilla.nightly', 'Firefox Nightly', [som(V, 'org.mozilla.nightly', 'Firefox Nightly'), som(O, 'org.mozilla.nightly', 'Firefox Nightly')], 'Vault', /never clicked by an agent/, false], + ...UAFGJORTE.map((g, i) => [`12e${i + 1}`, `ikke udelukket («${g.slice(0, 34)}…») i en webchat: afvist som adgangskode-side, ikke som Send`, 'com.google.Chrome', 'Google Chrome', [{ ...V, note: NOTE(g) }, { ...V, note: NOTE(g) }], 'WhatsApp', /could not be ruled out as a password manager page/, false]), + ['12k', 'et almindeligt punkt (Notes) bliver en vault under ventetiden: intet klik', 'com.apple.Notes', 'Notes', [som(O, 'com.apple.Notes', 'Notes'), som(V, 'com.apple.Notes', 'Notes')], 'Note', /now inside a password manager page/, false], + ['12l', 'kalibrering: et almindeligt OK-klik i Chrome (ikke vault, ikke chat) gaar igennem', 'com.google.Chrome', 'Google Chrome', [O, O], 'Dokument', null, true], + ]; + for (const [id, hvad, bid, navn, raekke, vindue, tekst, skalKlikke] of tilfaelde) { + const sp = lavFalskSpoerger('ja', 'cmcp-bundet-vault'); + const { srv, rpc, kald, hj } = klient({ apps: app(bid, navn), at: { _raekke: raekke }, samtale: { window: vindue } }, { CMCP_BACKGROUND: '0', CMCP_OSASCRIPT: sp.sti }); await rpc('initialize', { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'bundet', version: '1' } }); const r = await kald('computer_click', { x: 10, y: 20 }); const klik = hj.kald().filter(k => k.argv[0] === 'click'); - const spurgt = sp.gangeSpurgt() >= 1; - check(`${id} klik uden app: ${hvad}`, - klik.length === (skalKlikke ? 1 : 0) && (skalSpoerge ? spurgt : true) - // R8 (Opus O4): personen skal kunne se, at et ja klikker INDE i en adgangskode-side - && (!vaultTekst || sp.tekster().some(x => /password manager page/.test(x))), - `klik ${klik.length} · spurgt ${sp.gangeSpurgt()} · spoergsmaal ${JSON.stringify(sp.tekster().map(x => x.slice(0, 80)))} · ` + r.tekst.slice(0, 160)); + const ok = skalKlikke ? klik.length === 1 + : (klik.length === 0 && r.fejl && sp.gangeSpurgt() === 0 && tekst.test(r.tekst) && !/Send control|Nothing was sent/.test(r.tekst)); + check(`${id} klik uden app: ${hvad}`, ok, `klik ${klik.length} · spurgt ${sp.gangeSpurgt()} · ` + r.tekst.slice(0, 170)); srv.kill(); } } diff --git a/test/claims-offline.mjs b/test/claims-offline.mjs index dd62edbd..54b03b05 100644 --- a/test/claims-offline.mjs +++ b/test/claims-offline.mjs @@ -223,7 +223,7 @@ check('kontakten kan slaas fra, saa tallet kan efterproeves udefra', check('vault-porten: `at`-notens ordlyd er den, sende-dommen genkender (hjaelper og server i takt)', mainSw.includes('"note": "The point is inside \\(g); nothing from it is returned."') && /return erVaultAdresse\(u\) \? "a password manager page" : nil/.test(sw) - && srvTekst.includes("/^The point is inside a password manager page;/.test(String(d.note || ''))"), + && srvTekst.includes("/^The point is inside a password manager page;/.test(String(koordinatOpslag.note || ''))"), 'notens skabelon, vault-grunden eller serverens moenster er aendret uden de andre'); // R9: et program uden bundle-id kan ikke udelukkes som browser - i find OG inspect, som i fokus-vejen. check('vault-porten: program uden bundle-id regnes som mulig browser i find og inspect', From f71341ef7f36b225c86f1e2e2f154d6b044ee13c Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Thu, 5 Nov 2026 14:04:40 +0100 Subject: [PATCH 62/94] R10c efter Opus R10: et traek der er et klik eller har en ende i en vault afvises, og sende-dommen kender alle hjaelperens browsere - index.js: et traek (altid uden app) med en ende i en adgangskode-side afvises; et traek under 4 pt eller med begge ender paa samme element er et klik i forklaedning og afvises med henvisning til computer_click; genmaalingen fanger et traekpunkt der bliver vault (Opus R10-O1) - policy.js: BROWSERE = hjaelperens browsere (Chrome Beta/Dev/for Testing, Edge-kanaler, Brave Beta/Nightly, Firefox Nightly), sammenlignet uden store/smaa bogstaver + Chromes segmentregel (Opus R10-O6) - bundet-maal 13a-13e (mutanter: traek-som-klik 3 roede, vault-for-traek 2 roede); claims-offline: browserlisterne i takt (mutant roed) - flader: tools.js/tools.html, README, CHANGELOG, llms, security - hjaelperen uaendret: kandidaten 88866507 gaelder Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 8 +++++++- README.md | 3 ++- docs/llms.txt | 3 ++- docs/security.html | 2 +- docs/tools.html | 2 +- mcp-server/README.md | 3 ++- mcp-server/index.js | 26 ++++++++++++++++++++++++-- mcp-server/policy.js | 16 ++++++++++++---- mcp-server/tools.js | 2 +- test/bundet-maal.mjs | 29 +++++++++++++++++++++++++++++ test/claims-offline.mjs | 10 ++++++++++ 11 files changed, 91 insertions(+), 13 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1fed0c07..8868d8d0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -64,7 +64,13 @@ reason survive a navigation), and browsers outside the send gate's list clicked click without an app is judged by ONE lookup of the point, in every browser (`test/bundet-maal.mjs` 12d, 12f, 12i, 12i2, and 12e1-12e6 for every reason a page could not be ruled out; 12l checks that an ordinary click in Chrome still goes through; switching the refusal off turns ten of them red), -and a point that became such a page while an ordinary click waited is not clicked (12k). A web page whose address cannot be read - in any app, since the address rule applies +and a point that became such a page while an ordinary click waited is not clicked (12k). A drag is judged +too: one with an end in such a page is refused (13c, 13c2, 13d), and a drag shorter than 4 points or with both ends on +the same element - a click in disguise, since mouse down and up land on one control - is refused with a pointer to +`computer_click`, which goes through every click rule (13a, 13a2, 13b; 13e checks an ordinary drag still goes). The +send gate now knows every browser the helper knows - Chrome Beta, Dev and for Testing, Edge's three channels, Brave +Beta and Nightly, Firefox Nightly - compared without case, so a web chat's Send there is judged like in Chrome +(`test/claims-offline.mjs` keeps the two lists in step). A web page whose address cannot be read - in any app, since the address rule applies to web areas everywhere - or an element whose role cannot be read in a browser counts as one that cannot be ruled out. `version` lists `browser-password-pages`; `vault-url --url` answers the address rule on its diff --git a/README.md b/README.md index 660724a7..13315944 100644 --- a/README.md +++ b/README.md @@ -539,7 +539,8 @@ sit unnoticed until it expires. That is a real limitation today, not a setting. in screenshots, typing there is refused, and a click there is refused - with or without an app named, also a page that could not be ruled out, and nobody is asked (a yes to a blind click could not be tied to the - page). The address rule applies to a web page + page). So is a drag with an end there, and a drag that is really a click (under 4 + points, or both ends on one element). The address rule applies to a web page in any app, not only in a browser. A web page whose address cannot be read (in any app), or an element whose role cannot be read in a browser, is kept out of the reading tools too - that can also leave out ordinary content, and then a search diff --git a/docs/llms.txt b/docs/llms.txt index 18518c35..4c03a3aa 100644 --- a/docs/llms.txt +++ b/docs/llms.txt @@ -117,7 +117,8 @@ under a friendlier name. a suggestion menu in another page) are never returned by find, inspect or focused (press, set_value and wait_for say when they skipped one and found nothing), their window is blacked out whole, typing there is refused, and a click there is - refused, with or without an app named (nobody is asked). The address rule applies to + refused, with or without an app named (nobody is asked), and so is a drag with an end + there or a drag that is really a click (under 4 points, or both ends on one element). The address rule applies to a web page in any app; a page whose address, or a browser element whose role, cannot be read is left out too (a search then says it was incomplete). A guard against accidents, not a fence: Chrome's own password bubbles and autofill rows, non-text keys, diff --git a/docs/security.html b/docs/security.html index 4c19236f..2c42274c 100644 --- a/docs/security.html +++ b/docs/security.html @@ -199,7 +199,7 @@

Gate 1 - redaction happens before the file exists

Had we written the file first and redacted after, there would be a window - short, but real - where an unredacted picture of your desktop sat on disk for any other process to read. A security property with a race in it is not a security property.

Two things get painted:

    -
  • Secure text fields. Native fields expose the role AXSecureTextField. Fields in a web page expose the role AXTextField with the subrole AXSecureTextField. Checking only the role catches native fields and lets every browser password box through - which is the case that actually matters. We check both. A field in a web page is only visible once the browser shows its page to the accessibility layer: in Chrome this server switches that on (the switch a screen reader uses), and while a Chrome window's page is not readable yet - still being built, 3 to 15 seconds after it is first switched on, measured on Chrome 156, or empty - the whole window is painted over instead. Not covered: Safari, Firefox, Chromium browsers we do not name, Chrome app windows, and any browser when CMCP_INGEN_ELECTRON=1 is set. Known gaps, not measured: a field in a cross-site frame, or a login step that appears before Chrome has updated its tree. Password managers inside a browser are treated like native ones: a page whose address is the browser's own password page, a known web vault or one of eighteen known password-manager extensions in Chrome and Edge (also as a suggestion menu inside another page) is never returned by the reading tools (and the acting tools say when they skipped one and found nothing), its window is blacked out whole, typing there is refused, and a click there is refused - with or without an app named, also when the page could not be ruled out, and nobody is asked. The address rule applies to a web page in any app, not only a browser; a page whose address, or a browser element whose role, cannot be read is kept out of the reading tools too, and a search then says it was incomplete. Not recognised: a self-hosted vault, an unlisted extension, Safari's and Firefox's extension pages. Not hidden: window and menu titles (as for native apps), screen recordings, and Chrome's own password bubbles and autofill rows, which are native panels rather than pages. It is a guard against accidents, not a fence: keys that are not text, developer tools and the clipboard are not covered.
    • +
  • Secure text fields. Native fields expose the role AXSecureTextField. Fields in a web page expose the role AXTextField with the subrole AXSecureTextField. Checking only the role catches native fields and lets every browser password box through - which is the case that actually matters. We check both. A field in a web page is only visible once the browser shows its page to the accessibility layer: in Chrome this server switches that on (the switch a screen reader uses), and while a Chrome window's page is not readable yet - still being built, 3 to 15 seconds after it is first switched on, measured on Chrome 156, or empty - the whole window is painted over instead. Not covered: Safari, Firefox, Chromium browsers we do not name, Chrome app windows, and any browser when CMCP_INGEN_ELECTRON=1 is set. Known gaps, not measured: a field in a cross-site frame, or a login step that appears before Chrome has updated its tree. Password managers inside a browser are treated like native ones: a page whose address is the browser's own password page, a known web vault or one of eighteen known password-manager extensions in Chrome and Edge (also as a suggestion menu inside another page) is never returned by the reading tools (and the acting tools say when they skipped one and found nothing), its window is blacked out whole, typing there is refused, and a click there is refused - with or without an app named, also when the page could not be ruled out, and nobody is asked; so is a drag with an end there, and a drag that is really a click. The address rule applies to a web page in any app, not only a browser; a page whose address, or a browser element whose role, cannot be read is kept out of the reading tools too, and a search then says it was incomplete. Not recognised: a self-hosted vault, an unlisted extension, Safari's and Firefox's extension pages. Not hidden: window and menu titles (as for native apps), screen recordings, and Chrome's own password bubbles and autofill rows, which are native panels rather than pages. It is a guard against accidents, not a fence: keys that are not text, developer tools and the clipboard are not covered.
  • Whole windows of listed apps. Keychain Access, 1Password, Bitwarden, LastPass, Dashlane, Apple Passwords. We do not walk into those windows to decide what to hide; descending into a vault to work out what is secret is the mistake we are avoiding.

The rectangles are painted solid black, not blurred or pixelated. A good enough model can read through pixelation. It cannot read through black.

diff --git a/docs/tools.html b/docs/tools.html index 001f8376..6d42a9ed 100644 --- a/docs/tools.html +++ b/docs/tools.html @@ -238,7 +238,7 @@

computer_pendingread

In background mode a dialog is itself an interruption, so a write that would need one is refused rather than raised - and that refusal only reaches you if you happen to read the right conversation. This is where it becomes visible: what was asked for, when, and why it stopped. It is a list, not a button. Nothing here can be approved from here: a consent granted without a human is exactly what the gate exists to prevent. To allow the work, change the mode.

computer_dragwrite

-

Drag from one point to another: a file into a folder, a row into a new position, a slider to a value. Coordinates are in points, the same as computer_click - and computer_find hands you a center for every element it returns.

+

Drag from one point to another: a file into a folder, a row into a new position, a slider to a value. Coordinates are in points, the same as computer_click - and computer_find hands you a center for every element it returns. A drag shorter than 4 points, or with both ends on the same element, acts as a click and is refused - use computer_click, which is judged as one; a drag with an end in a password manager page is refused.

Like clicking, this moves the real cursor, so it is not the quiet route. Where an app publishes an accessibility tree, computer_press and computer_set_value do more without touching the pointer. And it reports that the drag was sent, never that it was accepted - only a screenshot or a fresh look at the tree can tell you that.

computer_spacewrite

diff --git a/mcp-server/README.md b/mcp-server/README.md index c55aaeed..1f76e9b2 100644 --- a/mcp-server/README.md +++ b/mcp-server/README.md @@ -537,7 +537,8 @@ sit unnoticed until it expires. That is a real limitation today, not a setting. in screenshots, typing there is refused, and a click there is refused - with or without an app named, also a page that could not be ruled out, and nobody is asked (a yes to a blind click could not be tied to the - page). The address rule applies to a web page + page). So is a drag with an end there, and a drag that is really a click (under 4 + points, or both ends on one element). The address rule applies to a web page in any app, not only in a browser. A web page whose address cannot be read (in any app), or an element whose role cannot be read in a browser, is kept out of the reading tools too - that can also leave out ordinary content, and then a search diff --git a/mcp-server/index.js b/mcp-server/index.js index 88273d7e..f1c52282 100644 --- a/mcp-server/index.js +++ b/mcp-server/index.js @@ -1681,6 +1681,10 @@ async function haandterKald(request) { // saa «vault» i ét og «OK-knap» i et andet gav et klik uden ja (ogsaa i browsere uden for beskedlisten). Nu doemmer // ÉT opslag alt (ejer, sende-dom, farlig-knap-dom), og genmaalingen under laasen binder ja'et til samme side. let koordinatOpslag = null; + // R10c (Opus R10-O1, MAALT): et traek uden app med samme start og slut (eller 1 pt) er et klik - mouseDown og mouseUp paa + // samme element - og gik uden om klik-dommen. Nu doemmes begge ender: et punkt i en adgangskode-side afviser, og to ender + // paa samme element (eller under 4 pt) afvises som et klik i forklaedning. + let koordinatVaultPunkt = null; const traekEnder = []; // ⛔ Runde 2: `computer_double_click` og `computer_right_click` stod her, men // findes ikke - dobbelt- og hoejreklik er `computer_click` med count/button. // `computer_scroll` uden app lander under markoeren; den vurderes ved markoeren. @@ -1699,6 +1703,8 @@ async function haandterKald(request) { try { ejer = await callHelper(vedMarkoer ? ['at', '--pointer'] : ['at', '--x', String(x), '--y', String(y)], { timeout: 8000 }); } catch {} if (ejer?.found && ejer.bundleId) ejere.push(ejer.bundleId); else ejerUkendt = true; if (name === 'computer_click' && punkter.length === 1 && !vedMarkoer && ejer?.found) koordinatOpslag = ejer; + if ((name === 'computer_click' || name === 'computer_drag') && !vedMarkoer && ejer?.password_page === true && !koordinatVaultPunkt) koordinatVaultPunkt = ejer; + if (name === 'computer_drag') traekEnder.push(ejer); // Vindues-stakken over punktet: klikket rammes af vindues-serveren, ikke af // tilgaengeligheds-laget. Alle kandidater vurderes (Fable, runde 2). for (const u of (Array.isArray(ejer?.under) ? ejer.under : [])) if (typeof u === 'string' && u && !ejere.includes(u)) ejere.push(u); @@ -2037,11 +2043,24 @@ async function haandterKald(request) { // note overlever en navigation eller et nyt element paa samme plads, og hjaelperen udleverer (med vilje) intet om siden. // Saa et klik uden app i en adgangskode-side - genkendt eller ikke udelukket - afvises nu, som et klik MED app: ingen // spoerges, intet klikkes, og personen tager trinnet selv. Doemt paa ét opslag (ejeren), i alle browsere. - if (name === 'computer_click' && !args.app && koordinatOpslag?.password_page === true) { + if (name === 'computer_drag' && !args.app && currentMode() !== 'readonly') { + const [a, b] = traekEnder; + const ramme = (e) => e?.frame && Number(e.frame.w) > 0 && Number(e.frame.h) > 0 ? JSON.stringify(e.frame) : null; + const kort = Math.hypot(Number(args.toX) - Number(args.fromX), Number(args.toY) - Number(args.fromY)) < 4; + const sammeElement = a?.found && b?.found && a.pid === b.pid && ramme(a) && ramme(a) === ramme(b); + if (kort || sammeElement) { + record({ tool: name, tier: tool.tier, args: scrubArgs(args), mode: currentMode(), target: targetBundleId, + decision: 'denied', asked: false, reason: `drag: ${kort ? 'shorter than 4 points' : 'both ends on the same element'} - it would act as a click` }); + return errorResult(`Refused: ${kort ? 'a drag shorter than 4 points' : 'a drag whose two ends are on the same element'} acts as a click on it, so it is judged as one. ` + + `Nothing was done, and nobody was asked. Use computer_click at the start point instead.`); + } + } + if ((name === 'computer_click' || name === 'computer_drag') && !args.app && koordinatVaultPunkt) { + const koordinatOpslag = koordinatVaultPunkt; const kendt = /^The point is inside a password manager page;/.test(String(koordinatOpslag.note || '')); record({ tool: name, tier: tool.tier, args: scrubArgs(args), mode: currentMode(), target: targetBundleId, decision: 'denied', asked: false, reason: `click: the point is inside ${kendt ? 'a password manager page' : 'a page that could not be ruled out as one'}` }); - return errorResult(`Refused: that point is inside ${kendt ? 'a password manager page' : 'a page that could not be ruled out as a password manager page'} (${koordinatOpslag.app || targetBundleId || 'a browser'}). ` + return errorResult(`Refused: ${name === 'computer_drag' ? 'a point of that drag' : 'that point'} is inside ${kendt ? 'a password manager page' : 'a page that could not be ruled out as a password manager page'} (${koordinatOpslag.app || targetBundleId || 'a browser'}). ` + `Like password manager apps, it is never clicked by an agent. Nothing was done, and nobody was asked; ask the person to do this step with computer_ask_user.`); } const sende = (effektivTier === TIER.READ || kunLaes) ? null : await sendeDom(name, args, targetBundleId, appKlik, koordinatOpslag); @@ -2187,6 +2206,9 @@ async function haandterKald(request) { try { e = await callHelper(vedMarkoer ? ['at', '--pointer'] : ['at', '--x', String(x), '--y', String(y)], { timeout: 8000 }); } catch {} if (!(e?.found && e.bundleId)) return 'the window under that point could not be confirmed just before acting'; if (koordinatOpslag && !vedMarkoer) nuKoordinat = e; + if (name === 'computer_drag' && !vedMarkoer && e.password_page === true) { + return 'a point of that drag is now inside a password manager page, or one that could not be ruled out, which an agent never acts in - ask the person to do this step with computer_ask_user'; + } for (const b of [e.bundleId, ...(Array.isArray(e.under) ? e.under : [])]) if (typeof b === 'string' && b && !nu.includes(b)) nu.push(b); } const somMaengde = (a) => [...new Set(a)].sort().join('|'); diff --git a/mcp-server/policy.js b/mcp-server/policy.js index 05210d6a..e8dbb0fa 100644 --- a/mcp-server/policy.js +++ b/mcp-server/policy.js @@ -149,11 +149,18 @@ export const MAIL_APPS = new Set([ 'org.mozilla.thunderbird' ]); export const BESKED_APPS = new Set([...CHAT_APPS, ...MAIL_APPS]); +// ⛔ R10c (Opus R10-O6, MAALT): listen var kortere end hjaelperens (Accessibility.swift chromiumBrowsere + andreBrowsere), saa +// en webchat-Send i Chrome Beta blev klikket uden spoergsmaal. Nu de samme id'er, sammenlignet uden store/smaa bogstaver, +// plus Chromes kanaler efter segmentreglen (com.google.chrome.*). test/claims-offline.mjs holder de to lister i takt. export const BROWSERE = new Set([ - 'com.apple.Safari', 'com.apple.SafariTechnologyPreview', 'com.google.Chrome', 'com.google.Chrome.canary', - 'org.chromium.Chromium', 'company.thebrowser.Browser', 'com.microsoft.edgemac', 'org.mozilla.firefox', - 'org.mozilla.firefoxdeveloperedition', 'com.brave.Browser', 'com.operasoftware.Opera', 'com.vivaldi.Vivaldi' + 'com.apple.Safari', 'com.apple.SafariTechnologyPreview', 'com.google.Chrome', 'com.google.Chrome.beta', + 'com.google.Chrome.dev', 'com.google.Chrome.canary', 'com.google.chrome.for.testing', + 'org.chromium.Chromium', 'company.thebrowser.Browser', 'com.microsoft.edgemac', 'com.microsoft.edgemac.Beta', + 'com.microsoft.edgemac.Dev', 'com.microsoft.edgemac.Canary', 'org.mozilla.firefox', + 'org.mozilla.firefoxdeveloperedition', 'org.mozilla.nightly', 'com.brave.Browser', 'com.brave.Browser.beta', + 'com.brave.Browser.nightly', 'com.operasoftware.Opera', 'com.vivaldi.Vivaldi' ]); +const BROWSERE_LAV = new Set([...BROWSERE].map((b) => b.toLowerCase())); // ⛔ Runde 2 30/9 (Astra 4, Fable 7): «Signal processing - Wikipedia» og «Teams of the // year» blev chat, «Google Chat» blev det ikke, og «Gmail - Slack» blev mail. Nu // forankrede navne, chat foerst (dér sender Return), og signal ude (ingen webklient). @@ -165,7 +172,8 @@ export function beskedSlags(bid) { if (!bid) return null; if (CHAT_APPS.has(bid)) return 'chat'; if (MAIL_APPS.has(bid)) return 'mail'; - if (BROWSERE.has(bid)) return 'browser'; + const lav = String(bid).toLowerCase(); + if (BROWSERE_LAV.has(lav) || /^com\.google\.chrome(\.|$)/.test(lav)) return 'browser'; return null; } diff --git a/mcp-server/tools.js b/mcp-server/tools.js index c3b142d2..8d13d6d3 100644 --- a/mcp-server/tools.js +++ b/mcp-server/tools.js @@ -75,7 +75,7 @@ export const TOOLS = [ { name: 'computer_drag', tier: TIER.WRITE, - description: 'Drag from one point to another: a file into a folder, a row into a new position in a list, a slider to a value. Coordinates are in POINTS, the same as computer_click - take them from computer_find, which gives you a center for every element it returns. Like clicking, this moves the real cursor, so it is not the quiet route; where an app publishes an accessibility tree, computer_press and computer_set_value do more without touching the pointer. It reports that the drag was sent, never that it was accepted - only a screenshot or a fresh look at the tree can tell you that.', + description: 'Drag from one point to another: a file into a folder, a row into a new position in a list, a slider to a value. Coordinates are in POINTS, the same as computer_click - take them from computer_find, which gives you a center for every element it returns. Like clicking, this moves the real cursor, so it is not the quiet route; where an app publishes an accessibility tree, computer_press and computer_set_value do more without touching the pointer. It reports that the drag was sent, never that it was accepted - only a screenshot or a fresh look at the tree can tell you that. A drag shorter than 4 points, or with both ends on the same element, acts as a click and is refused - use computer_click; a drag with an end in a password manager page is refused.', inputSchema: { type: 'object', properties: { diff --git a/test/bundet-maal.mjs b/test/bundet-maal.mjs index daf4f7df..3fcf9fb9 100644 --- a/test/bundet-maal.mjs +++ b/test/bundet-maal.mjs @@ -504,5 +504,34 @@ for (const [nr, tekst, args, rolle] of [ } } +// 13 · R10c (Opus R10-O1, MAALT): et traek (altid uden app) med to ender paa samme element - eller under 4 pt - er et klik +// i forklaedning og gik uden om klik-dommen; et traek i en adgangskode-side blev sendt uden spoergsmaal. Raekkefoelgen af +// `at`: [0] start, [1] slut (dommen), [2] start, [3] slut (genmaalingen under laasen). Forgrund; personen ville sige ja. +{ + const NOTE = 'The point is inside a password manager page; nothing from it is returned.'; + const E = (frame, extra = {}) => ({ found: true, app: 'Google Chrome', bundleId: 'com.google.Chrome', pid: 400, role: 'AXButton', title: 'OK', description: '', window: 'Dokument', frame, under: ['com.google.Chrome'], ...extra }); + const A = E({ x: 0, y: 0, w: 120, h: 30 }), B = E({ x: 0, y: 200, w: 120, h: 30 }); + const V = E({ x: 0, y: 0, w: 120, h: 30 }, { role: '', title: '', window: '', password_page: true, note: NOTE }); + const APPS = { apps: [{ name: 'Google Chrome', bundleId: 'com.google.Chrome', pid: 400, active: false }, { name: 'Finder', bundleId: 'com.apple.finder', pid: 300, active: true }] }; + for (const [id, hvad, fra, til, raekke, tekst, skalSendes] of [ + ['13a', 'traek paa 0 pt (start = slut): afvist som et klik', [10, 20], [10, 20], [A, A, A, A], /acts as a click/, false], + ['13a2', 'traek paa 3 pt: afvist som et klik', [10, 20], [12, 22], [A, A, A, A], /shorter than 4 points/, false], + ['13b', 'traek paa 40 pt med begge ender paa SAMME element: afvist som et klik', [10, 20], [50, 20], [A, A, A, A], /same element/, false], + ['13c', 'traek der starter i en adgangskode-side: afvist, ingen spurgt', [10, 20], [10, 220], [V, B, V, B], /a point of that drag is inside a password manager page/, false], + ['13c2', 'traek der ender i en adgangskode-side: afvist', [10, 220], [10, 20], [B, V, B, V], /a point of that drag is inside a password manager page/, false], + ['13d', 'traekkets slutpunkt bliver en adgangskode-side under ventetiden: intet traek', [10, 20], [10, 220], [A, B, A, { ...V, frame: B.frame }], /now inside a password manager page/, false], + ['13e', 'kalibrering: et almindeligt traek mellem to forskellige elementer sendes', [10, 20], [10, 220], [A, B, A, B], null, true], + ]) { + const sp = lavFalskSpoerger('ja', 'cmcp-bundet-traek'); + const { srv, rpc, kald, hj } = klient({ apps: APPS, at: { _raekke: raekke }, samtale: { window: 'Dokument' } }, { CMCP_BACKGROUND: '0', CMCP_OSASCRIPT: sp.sti }); + await rpc('initialize', { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'bundet', version: '1' } }); + const r = await kald('computer_drag', { fromX: fra[0], fromY: fra[1], toX: til[0], toY: til[1] }); + const traek = hj.kald().filter(k => k.argv[0] === 'drag'); + const ok = skalSendes ? traek.length === 1 : (traek.length === 0 && r.fejl && sp.gangeSpurgt() === 0 && tekst.test(r.tekst)); + check(`${id} ${hvad}`, ok, `traek ${traek.length} · spurgt ${sp.gangeSpurgt()} · ` + r.tekst.slice(0, 160)); + srv.kill(); + } +} + console.log(fails.length ? `DUMPET: ${fails.length} tjek` : 'Alle tjek bestået.'); process.exit(fails.length ? 1 : 0); diff --git a/test/claims-offline.mjs b/test/claims-offline.mjs index 54b03b05..900f87a4 100644 --- a/test/claims-offline.mjs +++ b/test/claims-offline.mjs @@ -239,6 +239,16 @@ check('kontakten kan slaas fra, saa tallet kan efterproeves udefra', 'en grund uden pid, eller etiket-funktionen er aendret'); check('vault-porten: en side hvis adresse ikke kunne laeses, goer find og inspect ufuldstaendige', (sw.match(/if g == vaultUkendtGrund \{ stoppedeTidligt = true \}/g) || []).length === 2, 'find eller inspect mangler reglen'); + // R10c (Opus R10-O6, MAALT): serverens beskedbrowsere var faerre end hjaelperens browsere - en webchat-Send i Chrome Beta gik + // uden om sende-dommen. Hver browser hjaelperen kender, skal vaere en browser for sende-dommen (to lister i takt). + { + const { beskedSlags } = await import(new URL('../mcp-server/policy.js', import.meta.url).href); + const liste = (navn) => (sw.match(new RegExp(`static let ${navn}: Set = \\[([\\s\\S]*?)\\]`)) || [, ''])[1].match(/"[^"]+"/g) || []; + const ids = [...liste('chromiumBrowsere'), ...liste('andreBrowsere')].map((x) => x.slice(1, -1)); + const mangler = ids.filter((b) => beskedSlags(b) !== 'browser'); + check(`sende-dommen kender alle ${ids.length} browsere hjaelperen kender (og Chromes kanaler efter segmentreglen)`, + ids.length >= 18 && mangler.length === 0 && beskedSlags('com.google.chrome.for.testing') === 'browser', `mangler: ${mangler.join(', ')}`); + } check('vault-porten: wait-for og et tomt soegeresultat siger, at adgangskode-sider ikke blev gennemsoegt', /password manager page\(s\) were not searched; their content is never returned/.test(mainSw) && /password manager page\(s\) were not searched; like password manager apps/.test(mainSw), 'wait-for eller not-found tier om sprungne sider'); From f15327455325d675f7277906e7173e05dcdf42f6 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Thu, 5 Nov 2026 14:43:03 +0100 Subject: [PATCH 63/94] =?UTF-8?q?R11=20efter=20Astra=20R11:=20et=20traeks?= =?UTF-8?q?=20startpunkt=20doemmes=20praecis=20som=20et=20klik=20-=20ingen?= =?UTF-8?q?=20=C2=ABsamme=20element=C2=BB-heuristik?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - index.js: KLIK_LIG/klikPunkt - sende-dommen, knapErFarlig og ét-opslag-reglen gaelder et traeks startpunkt (mouseDown, og hjaelperens stopvej giver mouseUp samme sted); genmaalingen bruger startpunktets nye opslag; vault ved begge ender afvises stadig. «Samme element / under 4 pt»-reglen er fjernet: den blev omgaaet (genmaaling, tom ramme) og blokerede skydere og tekstmarkering (Astra R11-2/R11-3) - bundet-maal 13a/13b/13h/13i (Send ved startpunktet, Astras genmaaling, tom ramme), 13f/13g (skyder, tekst gaar igennem), 12m (ét opslag + genmaaling; Astras mutant S er nu roed). Mutanter: traek ikke som klik -> 4 roede; eget opslag -> 12m roed - flader: tools.js/tools.html, README, CHANGELOG, llms, security - hjaelperen uaendret: kandidaten 88866507 gaelder Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 8 +++++--- README.md | 4 ++-- docs/llms.txt | 2 +- docs/security.html | 2 +- docs/tools.html | 2 +- mcp-server/README.md | 4 ++-- mcp-server/index.js | 43 ++++++++++++++++++-------------------- mcp-server/tools.js | 2 +- test/bundet-maal.mjs | 49 +++++++++++++++++++++++++++++++------------- 9 files changed, 68 insertions(+), 48 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 8868d8d0..02fbf9c2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -65,9 +65,11 @@ click without an app is judged by ONE lookup of the point, in every browser (`te 12d, 12f, 12i, 12i2, and 12e1-12e6 for every reason a page could not be ruled out; 12l checks that an ordinary click in Chrome still goes through; switching the refusal off turns ten of them red), and a point that became such a page while an ordinary click waited is not clicked (12k). A drag is judged -too: one with an end in such a page is refused (13c, 13c2, 13d), and a drag shorter than 4 points or with both ends on -the same element - a click in disguise, since mouse down and up land on one control - is refused with a pointer to -`computer_click`, which goes through every click rule (13a, 13a2, 13b; 13e checks an ordinary drag still goes). The +too: one with an end in such a page is refused (13c, 13c2, 13d), and its start point is judged exactly like a click there - +the send gate, the dangerous-button rule, the same single lookup and the recheck under the lock - since the mouse goes +down on it and the helper's stop path lets it up in the same place (13a, 13b, 13h, 13i; a guess at «the same element» +was measured to be bypassed and to block sliders and text selection, so it was dropped: 13f, 13g, and 13e for an +ordinary drag, still go through). The send gate now knows every browser the helper knows - Chrome Beta, Dev and for Testing, Edge's three channels, Brave Beta and Nightly, Firefox Nightly - compared without case, so a web chat's Send there is judged like in Chrome (`test/claims-offline.mjs` keeps the two lists in step). A web page whose address cannot be read - in any app, since the address rule applies diff --git a/README.md b/README.md index 13315944..0639dbb2 100644 --- a/README.md +++ b/README.md @@ -539,8 +539,8 @@ sit unnoticed until it expires. That is a real limitation today, not a setting. in screenshots, typing there is refused, and a click there is refused - with or without an app named, also a page that could not be ruled out, and nobody is asked (a yes to a blind click could not be tied to the - page). So is a drag with an end there, and a drag that is really a click (under 4 - points, or both ends on one element). The address rule applies to a web page + page). So is a drag with an end there; a drag's start point is judged exactly like + a click (the mouse goes down on it). The address rule applies to a web page in any app, not only in a browser. A web page whose address cannot be read (in any app), or an element whose role cannot be read in a browser, is kept out of the reading tools too - that can also leave out ordinary content, and then a search diff --git a/docs/llms.txt b/docs/llms.txt index 4c03a3aa..7eae05e0 100644 --- a/docs/llms.txt +++ b/docs/llms.txt @@ -118,7 +118,7 @@ under a friendlier name. (press, set_value and wait_for say when they skipped one and found nothing), their window is blacked out whole, typing there is refused, and a click there is refused, with or without an app named (nobody is asked), and so is a drag with an end - there or a drag that is really a click (under 4 points, or both ends on one element). The address rule applies to + there; a drag's start point is judged exactly like a click. The address rule applies to a web page in any app; a page whose address, or a browser element whose role, cannot be read is left out too (a search then says it was incomplete). A guard against accidents, not a fence: Chrome's own password bubbles and autofill rows, non-text keys, diff --git a/docs/security.html b/docs/security.html index 2c42274c..22f5fb71 100644 --- a/docs/security.html +++ b/docs/security.html @@ -199,7 +199,7 @@

Gate 1 - redaction happens before the file exists

Had we written the file first and redacted after, there would be a window - short, but real - where an unredacted picture of your desktop sat on disk for any other process to read. A security property with a race in it is not a security property.

Two things get painted:

    -
  • Secure text fields. Native fields expose the role AXSecureTextField. Fields in a web page expose the role AXTextField with the subrole AXSecureTextField. Checking only the role catches native fields and lets every browser password box through - which is the case that actually matters. We check both. A field in a web page is only visible once the browser shows its page to the accessibility layer: in Chrome this server switches that on (the switch a screen reader uses), and while a Chrome window's page is not readable yet - still being built, 3 to 15 seconds after it is first switched on, measured on Chrome 156, or empty - the whole window is painted over instead. Not covered: Safari, Firefox, Chromium browsers we do not name, Chrome app windows, and any browser when CMCP_INGEN_ELECTRON=1 is set. Known gaps, not measured: a field in a cross-site frame, or a login step that appears before Chrome has updated its tree. Password managers inside a browser are treated like native ones: a page whose address is the browser's own password page, a known web vault or one of eighteen known password-manager extensions in Chrome and Edge (also as a suggestion menu inside another page) is never returned by the reading tools (and the acting tools say when they skipped one and found nothing), its window is blacked out whole, typing there is refused, and a click there is refused - with or without an app named, also when the page could not be ruled out, and nobody is asked; so is a drag with an end there, and a drag that is really a click. The address rule applies to a web page in any app, not only a browser; a page whose address, or a browser element whose role, cannot be read is kept out of the reading tools too, and a search then says it was incomplete. Not recognised: a self-hosted vault, an unlisted extension, Safari's and Firefox's extension pages. Not hidden: window and menu titles (as for native apps), screen recordings, and Chrome's own password bubbles and autofill rows, which are native panels rather than pages. It is a guard against accidents, not a fence: keys that are not text, developer tools and the clipboard are not covered.
    • +
  • Secure text fields. Native fields expose the role AXSecureTextField. Fields in a web page expose the role AXTextField with the subrole AXSecureTextField. Checking only the role catches native fields and lets every browser password box through - which is the case that actually matters. We check both. A field in a web page is only visible once the browser shows its page to the accessibility layer: in Chrome this server switches that on (the switch a screen reader uses), and while a Chrome window's page is not readable yet - still being built, 3 to 15 seconds after it is first switched on, measured on Chrome 156, or empty - the whole window is painted over instead. Not covered: Safari, Firefox, Chromium browsers we do not name, Chrome app windows, and any browser when CMCP_INGEN_ELECTRON=1 is set. Known gaps, not measured: a field in a cross-site frame, or a login step that appears before Chrome has updated its tree. Password managers inside a browser are treated like native ones: a page whose address is the browser's own password page, a known web vault or one of eighteen known password-manager extensions in Chrome and Edge (also as a suggestion menu inside another page) is never returned by the reading tools (and the acting tools say when they skipped one and found nothing), its window is blacked out whole, typing there is refused, and a click there is refused - with or without an app named, also when the page could not be ruled out, and nobody is asked; so is a drag with an end there, and a drag's start point is judged exactly like a click. The address rule applies to a web page in any app, not only a browser; a page whose address, or a browser element whose role, cannot be read is kept out of the reading tools too, and a search then says it was incomplete. Not recognised: a self-hosted vault, an unlisted extension, Safari's and Firefox's extension pages. Not hidden: window and menu titles (as for native apps), screen recordings, and Chrome's own password bubbles and autofill rows, which are native panels rather than pages. It is a guard against accidents, not a fence: keys that are not text, developer tools and the clipboard are not covered.
  • Whole windows of listed apps. Keychain Access, 1Password, Bitwarden, LastPass, Dashlane, Apple Passwords. We do not walk into those windows to decide what to hide; descending into a vault to work out what is secret is the mistake we are avoiding.

The rectangles are painted solid black, not blurred or pixelated. A good enough model can read through pixelation. It cannot read through black.

diff --git a/docs/tools.html b/docs/tools.html index 6d42a9ed..d3ff1fe8 100644 --- a/docs/tools.html +++ b/docs/tools.html @@ -238,7 +238,7 @@

computer_pendingread

In background mode a dialog is itself an interruption, so a write that would need one is refused rather than raised - and that refusal only reaches you if you happen to read the right conversation. This is where it becomes visible: what was asked for, when, and why it stopped. It is a list, not a button. Nothing here can be approved from here: a consent granted without a human is exactly what the gate exists to prevent. To allow the work, change the mode.

computer_dragwrite

-

Drag from one point to another: a file into a folder, a row into a new position, a slider to a value. Coordinates are in points, the same as computer_click - and computer_find hands you a center for every element it returns. A drag shorter than 4 points, or with both ends on the same element, acts as a click and is refused - use computer_click, which is judged as one; a drag with an end in a password manager page is refused.

+

Drag from one point to another: a file into a folder, a row into a new position, a slider to a value. Coordinates are in points, the same as computer_click - and computer_find hands you a center for every element it returns. Its start point is judged exactly like a click there - a Send button, a dangerous button, a password manager page - since the mouse goes down on it; a drag with an end in a password manager page is refused.

Like clicking, this moves the real cursor, so it is not the quiet route. Where an app publishes an accessibility tree, computer_press and computer_set_value do more without touching the pointer. And it reports that the drag was sent, never that it was accepted - only a screenshot or a fresh look at the tree can tell you that.

computer_spacewrite

diff --git a/mcp-server/README.md b/mcp-server/README.md index 1f76e9b2..a45aad28 100644 --- a/mcp-server/README.md +++ b/mcp-server/README.md @@ -537,8 +537,8 @@ sit unnoticed until it expires. That is a real limitation today, not a setting. in screenshots, typing there is refused, and a click there is refused - with or without an app named, also a page that could not be ruled out, and nobody is asked (a yes to a blind click could not be tied to the - page). So is a drag with an end there, and a drag that is really a click (under 4 - points, or both ends on one element). The address rule applies to a web page + page). So is a drag with an end there; a drag's start point is judged exactly like + a click (the mouse goes down on it). The address rule applies to a web page in any app, not only in a browser. A web page whose address cannot be read (in any app), or an element whose role cannot be read in a browser, is kept out of the reading tools too - that can also leave out ordinary content, and then a search diff --git a/mcp-server/index.js b/mcp-server/index.js index f1c52282..1b690376 100644 --- a/mcp-server/index.js +++ b/mcp-server/index.js @@ -677,11 +677,19 @@ async function trykForhaand(args) { /// Klikkets halvdel af porten. Trykkets ligger i `trykForhaand` (7/10): et klik kan /// ramme noget tilgaengelighedslaget ikke ser (canvas, fjernskrivebord), saa «intet /// fundet» spoerger her fortsat - et tryk uden fundet element kan slet ikke ske. +// ⛔ R11 (Astra, MAALT): et traek sender mouseDown paa startpunktet, og hjaelperens stopvej sender mouseUp samme sted +// (Input.swift) - et traek KAN altsaa vaere et klik paa startpunktet, uanset laengde og «samme element». Gaet om det +// blev omgaaet (genmaalingen, tom ramme). Nu doemmes et traeks STARTPUNKT praecis som et klik: sende-dom, farlige +// knapper og adgangskode-sider; skydere og tekstmarkering blokeres ikke af en heuristik. +const KLIK_LIG = (name) => name === 'computer_click' || name === 'computer_drag'; +const klikPunkt = (name, args) => name === 'computer_drag' ? [args.fromX, args.fromY] : [args.x, args.y]; + async function knapErFarlig(name, args, appKlik = null, forhaand = null) { - if (name === 'computer_click' && Number.isFinite(args.x) && Number.isFinite(args.y)) { + const [kx, ky] = klikPunkt(name, args); + if (KLIK_LIG(name) && Number.isFinite(kx) && Number.isFinite(ky)) { try { // R27: med `app` er det maalprogrammets eget element (doemt i porten), ikke det oeverste vindue. - const d = appKlik || forhaand || await callHelper(['at', '--x', String(args.x), '--y', String(args.y)], { timeout: 8000 }); + const d = appKlik || forhaand || await callHelper(['at', '--x', String(kx), '--y', String(ky)], { timeout: 8000 }); if (!d?.found) return true; // R4 5/11 (Astra): et punkt i en adgangskode-side inde i en browser er lige saa farligt som et adgangskode-program. if (d.password_page) return true; @@ -710,8 +718,9 @@ async function sendeDom(name, args, bid, appKlik = null, forhaand = null) { const el = d.would_press; kontrolSvar = el ? { navne: [el.name, ...(el.names || []), el.title], rolle: el.role, vindue: el.window || null, ramme: el.frame || null, fundet: true } : { fejl: true }; - } else if (name === 'computer_click') { - const d = appKlik || forhaand || await callHelper(['at', '--x', String(args.x), '--y', String(args.y)], { timeout: 8000 }); + } else if (KLIK_LIG(name)) { + const [kx, ky] = klikPunkt(name, args); + const d = appKlik || forhaand || await callHelper(['at', '--x', String(kx), '--y', String(ky)], { timeout: 8000 }); kontrolSvar = { navne: [d.title, d.description], rolle: d.role, vindue: d.window || null, ramme: d.frame || null, fundet: !!d.found, andetProgram: d.bundleId !== bid }; } else kontrolSvar = null; @@ -765,14 +774,14 @@ async function sendeDom(name, args, bid, appKlik = null, forhaand = null) { } } if (name === 'computer_menu') sender = SENDE_ORD.test(String(args.path || '').split('>').pop() || ''); - if (name === 'computer_press' || name === 'computer_click') { + if (name === 'computer_press' || KLIK_LIG(name)) { // erKontrol FOER opslaget: et opslag der fejler, maa ikke springe bindingen over. erKontrol = true; const k = await kontrol(); if (!k || k.fejl) sender = true; else { // Intet element, et andet program foran, eller et element UDEN navn: vi ved ikke hvad det er - saa er det en mulig send. - sender = (name === 'computer_click' && (!k.fundet || k.andetProgram)) || navnSender(k.navne, k.rolle, name === 'computer_click'); + sender = (KLIK_LIG(name) && (!k.fundet || k.andetProgram)) || navnSender(k.navne, k.rolle, KLIK_LIG(name)); knapVindue = k.vindue; knapRamme = k.ramme; } } @@ -1681,9 +1690,8 @@ async function haandterKald(request) { // saa «vault» i ét og «OK-knap» i et andet gav et klik uden ja (ogsaa i browsere uden for beskedlisten). Nu doemmer // ÉT opslag alt (ejer, sende-dom, farlig-knap-dom), og genmaalingen under laasen binder ja'et til samme side. let koordinatOpslag = null; - // R10c (Opus R10-O1, MAALT): et traek uden app med samme start og slut (eller 1 pt) er et klik - mouseDown og mouseUp paa - // samme element - og gik uden om klik-dommen. Nu doemmes begge ender: et punkt i en adgangskode-side afviser, og to ender - // paa samme element (eller under 4 pt) afvises som et klik i forklaedning. + // R10c/R11 (Opus R10-O1, Astra R11): et traek kan vaere et klik paa startpunktet. Begge ender doemmes for adgangskode-sider, + // og startpunktets opslag er dommens (koordinatOpslag), saa sende-dom og knap-dom gaelder det som et klik. let koordinatVaultPunkt = null; const traekEnder = []; // ⛔ Runde 2: `computer_double_click` og `computer_right_click` stod her, men // findes ikke - dobbelt- og hoejreklik er `computer_click` med count/button. @@ -1703,6 +1711,7 @@ async function haandterKald(request) { try { ejer = await callHelper(vedMarkoer ? ['at', '--pointer'] : ['at', '--x', String(x), '--y', String(y)], { timeout: 8000 }); } catch {} if (ejer?.found && ejer.bundleId) ejere.push(ejer.bundleId); else ejerUkendt = true; if (name === 'computer_click' && punkter.length === 1 && !vedMarkoer && ejer?.found) koordinatOpslag = ejer; + if (name === 'computer_drag' && !vedMarkoer && ejer?.found && koordinatOpslag === null && traekEnder.length === 0) koordinatOpslag = ejer; if ((name === 'computer_click' || name === 'computer_drag') && !vedMarkoer && ejer?.password_page === true && !koordinatVaultPunkt) koordinatVaultPunkt = ejer; if (name === 'computer_drag') traekEnder.push(ejer); // Vindues-stakken over punktet: klikket rammes af vindues-serveren, ikke af @@ -2043,18 +2052,6 @@ async function haandterKald(request) { // note overlever en navigation eller et nyt element paa samme plads, og hjaelperen udleverer (med vilje) intet om siden. // Saa et klik uden app i en adgangskode-side - genkendt eller ikke udelukket - afvises nu, som et klik MED app: ingen // spoerges, intet klikkes, og personen tager trinnet selv. Doemt paa ét opslag (ejeren), i alle browsere. - if (name === 'computer_drag' && !args.app && currentMode() !== 'readonly') { - const [a, b] = traekEnder; - const ramme = (e) => e?.frame && Number(e.frame.w) > 0 && Number(e.frame.h) > 0 ? JSON.stringify(e.frame) : null; - const kort = Math.hypot(Number(args.toX) - Number(args.fromX), Number(args.toY) - Number(args.fromY)) < 4; - const sammeElement = a?.found && b?.found && a.pid === b.pid && ramme(a) && ramme(a) === ramme(b); - if (kort || sammeElement) { - record({ tool: name, tier: tool.tier, args: scrubArgs(args), mode: currentMode(), target: targetBundleId, - decision: 'denied', asked: false, reason: `drag: ${kort ? 'shorter than 4 points' : 'both ends on the same element'} - it would act as a click` }); - return errorResult(`Refused: ${kort ? 'a drag shorter than 4 points' : 'a drag whose two ends are on the same element'} acts as a click on it, so it is judged as one. ` - + `Nothing was done, and nobody was asked. Use computer_click at the start point instead.`); - } - } if ((name === 'computer_click' || name === 'computer_drag') && !args.app && koordinatVaultPunkt) { const koordinatOpslag = koordinatVaultPunkt; const kendt = /^The point is inside a password manager page;/.test(String(koordinatOpslag.note || '')); @@ -2074,7 +2071,7 @@ async function haandterKald(request) { && (menuSerFarlig(args.path) || await menuGenvejErFarlig(appArg(args), args.path)); const knapFarlig = effektivTier !== TIER.READ && !kunLaes && ( name === 'computer_press' ? !!trykDom?.farlig - : name === 'computer_click' ? await knapErFarlig(name, args, appKlik, koordinatOpslag) : false); + : KLIK_LIG(name) ? await knapErFarlig(name, args, appKlik, koordinatOpslag) : false); // R47 (Astra): hvilket sessionssamtykke fandtes FOER dette kalds spoergsmaal - saa et stoppet kalds sene ja kun // tager det tilbage, DET selv gav, og ikke et nyere ja mennesket har givet et andet kald imens. @@ -2205,7 +2202,7 @@ async function haandterKald(request) { let e = null; try { e = await callHelper(vedMarkoer ? ['at', '--pointer'] : ['at', '--x', String(x), '--y', String(y)], { timeout: 8000 }); } catch {} if (!(e?.found && e.bundleId)) return 'the window under that point could not be confirmed just before acting'; - if (koordinatOpslag && !vedMarkoer) nuKoordinat = e; + if (koordinatOpslag && !vedMarkoer && nuKoordinat === null) nuKoordinat = e; if (name === 'computer_drag' && !vedMarkoer && e.password_page === true) { return 'a point of that drag is now inside a password manager page, or one that could not be ruled out, which an agent never acts in - ask the person to do this step with computer_ask_user'; } diff --git a/mcp-server/tools.js b/mcp-server/tools.js index 8d13d6d3..e7269595 100644 --- a/mcp-server/tools.js +++ b/mcp-server/tools.js @@ -75,7 +75,7 @@ export const TOOLS = [ { name: 'computer_drag', tier: TIER.WRITE, - description: 'Drag from one point to another: a file into a folder, a row into a new position in a list, a slider to a value. Coordinates are in POINTS, the same as computer_click - take them from computer_find, which gives you a center for every element it returns. Like clicking, this moves the real cursor, so it is not the quiet route; where an app publishes an accessibility tree, computer_press and computer_set_value do more without touching the pointer. It reports that the drag was sent, never that it was accepted - only a screenshot or a fresh look at the tree can tell you that. A drag shorter than 4 points, or with both ends on the same element, acts as a click and is refused - use computer_click; a drag with an end in a password manager page is refused.', + description: 'Drag from one point to another: a file into a folder, a row into a new position in a list, a slider to a value. Coordinates are in POINTS, the same as computer_click - take them from computer_find, which gives you a center for every element it returns. Like clicking, this moves the real cursor, so it is not the quiet route; where an app publishes an accessibility tree, computer_press and computer_set_value do more without touching the pointer. It reports that the drag was sent, never that it was accepted - only a screenshot or a fresh look at the tree can tell you that. Its start point is judged exactly like a click there (a Send button, a dangerous button, a password manager page), since the mouse goes down on it; a drag with an end in a password manager page is refused.', inputSchema: { type: 'object', properties: { diff --git a/test/bundet-maal.mjs b/test/bundet-maal.mjs index 3fcf9fb9..74afeb44 100644 --- a/test/bundet-maal.mjs +++ b/test/bundet-maal.mjs @@ -504,34 +504,55 @@ for (const [nr, tekst, args, rolle] of [ } } -// 13 · R10c (Opus R10-O1, MAALT): et traek (altid uden app) med to ender paa samme element - eller under 4 pt - er et klik -// i forklaedning og gik uden om klik-dommen; et traek i en adgangskode-side blev sendt uden spoergsmaal. Raekkefoelgen af -// `at`: [0] start, [1] slut (dommen), [2] start, [3] slut (genmaalingen under laasen). Forgrund; personen ville sige ja. +// 13 · R10c/R11 (Opus R10-O1, Astra R11, MAALT): et traek (altid uden app) sender mouseDown paa startpunktet, og hjaelperens +// stopvej sender mouseUp samme sted - startpunktet doemmes derfor praecis som et klik (sende-dom, farlige knapper, +// adgangskode-sider); en ende i en adgangskode-side afvises. Ingen «samme element»-heuristik: skydere og tekstmarkering +// gaar igennem. Raekkefoelgen af `at`: [0] start, [1] slut (dommen), [2] start, [3] slut (genmaalingen). Forgrund. { const NOTE = 'The point is inside a password manager page; nothing from it is returned.'; const E = (frame, extra = {}) => ({ found: true, app: 'Google Chrome', bundleId: 'com.google.Chrome', pid: 400, role: 'AXButton', title: 'OK', description: '', window: 'Dokument', frame, under: ['com.google.Chrome'], ...extra }); const A = E({ x: 0, y: 0, w: 120, h: 30 }), B = E({ x: 0, y: 200, w: 120, h: 30 }); + const SEND = E({ x: 400, y: 600, w: 40, h: 30 }, { title: 'Send', window: 'WhatsApp' }); + const SEND_TOM = E({}, { title: 'Send', window: 'WhatsApp' }); + const SLIDER = E({ x: 0, y: 0, w: 300, h: 20 }, { role: 'AXSlider', title: '' }); + const TEKST = E({ x: 0, y: 0, w: 400, h: 200 }, { role: 'AXTextArea', title: '' }); const V = E({ x: 0, y: 0, w: 120, h: 30 }, { role: '', title: '', window: '', password_page: true, note: NOTE }); const APPS = { apps: [{ name: 'Google Chrome', bundleId: 'com.google.Chrome', pid: 400, active: false }, { name: 'Finder', bundleId: 'com.apple.finder', pid: 300, active: true }] }; - for (const [id, hvad, fra, til, raekke, tekst, skalSendes] of [ - ['13a', 'traek paa 0 pt (start = slut): afvist som et klik', [10, 20], [10, 20], [A, A, A, A], /acts as a click/, false], - ['13a2', 'traek paa 3 pt: afvist som et klik', [10, 20], [12, 22], [A, A, A, A], /shorter than 4 points/, false], - ['13b', 'traek paa 40 pt med begge ender paa SAMME element: afvist som et klik', [10, 20], [50, 20], [A, A, A, A], /same element/, false], - ['13c', 'traek der starter i en adgangskode-side: afvist, ingen spurgt', [10, 20], [10, 220], [V, B, V, B], /a point of that drag is inside a password manager page/, false], - ['13c2', 'traek der ender i en adgangskode-side: afvist', [10, 220], [10, 20], [B, V, B, V], /a point of that drag is inside a password manager page/, false], - ['13d', 'traekkets slutpunkt bliver en adgangskode-side under ventetiden: intet traek', [10, 20], [10, 220], [A, B, A, { ...V, frame: B.frame }], /now inside a password manager page/, false], - ['13e', 'kalibrering: et almindeligt traek mellem to forskellige elementer sendes', [10, 20], [10, 220], [A, B, A, B], null, true], + for (const [id, hvad, fra, til, raekke, vindue, tekst, skalSendes] of [ + ['13a', 'traek paa 0 pt fra en webchat-Send: sende-dommen, intet traek uden en dom', [410, 610], [410, 610], [SEND, SEND, SEND, SEND], 'WhatsApp', /Send control|Nothing was sent|person said no/, false], + ['13b', 'traek paa 200 pt der STARTER paa en webchat-Send: sende-dommen gaelder startpunktet', [410, 610], [410, 210], [SEND, B, SEND, B], 'WhatsApp', /Send control|Nothing was sent|person said no/, false], + ['13h', 'dommen ser almindelige elementer, genmaalingen ser Send paa startpunktet (Astra R11): intet traek', [10, 20], [10, 220], [A, B, SEND, B], 'WhatsApp', /changed|Send control|not sent/, false], + ['13i', 'Send med tom ramme (frame {}) i begge ender (Astra R11): sende-dommen, intet traek', [410, 610], [450, 610], [SEND_TOM, SEND_TOM, SEND_TOM, SEND_TOM], 'WhatsApp', /Send control|Nothing was sent|person said no/, false], + ['13c', 'traek der starter i en adgangskode-side: afvist, ingen spurgt', [10, 20], [10, 220], [V, B, V, B], 'Dokument', /a point of that drag is inside a password manager page/, false], + ['13c2', 'traek der ender i en adgangskode-side: afvist', [10, 220], [10, 20], [B, V, B, V], 'Dokument', /a point of that drag is inside a password manager page/, false], + ['13d', 'traekkets slutpunkt bliver en adgangskode-side under ventetiden: intet traek', [10, 20], [10, 220], [A, B, A, { ...V, frame: B.frame }], 'Dokument', /now inside a password manager page/, false], + ['13e', 'kalibrering: et almindeligt traek mellem to forskellige elementer sendes', [10, 20], [10, 220], [A, B, A, B], 'Dokument', null, true], + ['13f', 'traek inden for en skyder (samme element) sendes - ingen over-blokering (Astra R11)', [10, 10], [200, 10], [SLIDER, SLIDER, SLIDER, SLIDER], 'Dokument', null, true], + ['13g', 'tekstmarkering inden for et tekstfelt (samme element) sendes (Astra R11)', [10, 10], [300, 150], [TEKST, TEKST, TEKST, TEKST], 'Dokument', null, true], ]) { - const sp = lavFalskSpoerger('ja', 'cmcp-bundet-traek'); - const { srv, rpc, kald, hj } = klient({ apps: APPS, at: { _raekke: raekke }, samtale: { window: 'Dokument' } }, { CMCP_BACKGROUND: '0', CMCP_OSASCRIPT: sp.sti }); + const sp = lavFalskSpoerger('udloeb', 'cmcp-bundet-traek'); + const { srv, rpc, kald, hj } = klient({ apps: APPS, at: { _raekke: raekke }, samtale: { window: vindue } }, { CMCP_BACKGROUND: '0', CMCP_OSASCRIPT: sp.sti }); await rpc('initialize', { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'bundet', version: '1' } }); const r = await kald('computer_drag', { fromX: fra[0], fromY: fra[1], toX: til[0], toY: til[1] }); const traek = hj.kald().filter(k => k.argv[0] === 'drag'); - const ok = skalSendes ? traek.length === 1 : (traek.length === 0 && r.fejl && sp.gangeSpurgt() === 0 && tekst.test(r.tekst)); + const ok = skalSendes ? traek.length === 1 : (traek.length === 0 && r.fejl && tekst.test(r.tekst)); check(`${id} ${hvad}`, ok, `traek ${traek.length} · spurgt ${sp.gangeSpurgt()} · ` + r.tekst.slice(0, 160)); srv.kill(); } } +// 12m · R11 (Astra, mutant S): et klik uden app doemmes paa ÉT opslag - sende-dommen og knapErFarlig genbruger ejerens. +// Et almindeligt klik i en browser giver derfor praecis to `at`: dommen og genmaalingen under laasen. +{ + const O = { found: true, app: 'Google Chrome', bundleId: 'com.google.Chrome', pid: 400, role: 'AXButton', title: 'OK', description: '', window: 'Dokument', frame: { x: 0, y: 0, w: 120, h: 30 }, under: ['com.google.Chrome'] }; + const { srv, rpc, kald, hj } = klient({ apps: { apps: [{ name: 'Google Chrome', bundleId: 'com.google.Chrome', pid: 400, active: false }, { name: 'Finder', bundleId: 'com.apple.finder', pid: 300, active: true }] }, + at: O, samtale: { window: 'Dokument' } }, { CMCP_BACKGROUND: '0' }); + await rpc('initialize', { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'bundet', version: '1' } }); + const r = await kald('computer_click', { x: 10, y: 20 }); + const at = hj.kald().filter(k => k.argv[0] === 'at'), klik = hj.kald().filter(k => k.argv[0] === 'click'); + check('12m klik uden app i en browser: ét opslag til dommen + ét til genmaalingen (ingen egne opslag i sende-dom og knap-dom)', + klik.length === 1 && at.length === 2, `at ${at.length} · klik ${klik.length} · ` + r.tekst.slice(0, 100)); + srv.kill(); +} console.log(fails.length ? `DUMPET: ${fails.length} tjek` : 'Alle tjek bestået.'); process.exit(fails.length ? 1 : 0); From 948417a54f193024c83d302f75d017d0af0de491 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Thu, 5 Nov 2026 15:33:43 +0100 Subject: [PATCH 64/94] R12 efter Astra R12: sende-dommen gaelder startpunktets ejer, og genmaalingen kraever samme ejer under startpunktet 13j: traek fra en Chrome-Send til Terminal fik ingen sende-dom (samtykket gjaldt Terminal). 13k: start og slut byttede ejer under ventetiden og passerede som maengde. Mutanter: sendeBid = targetBundleId -> 13j roed; ordnet ejer-tjek fjernet -> 13k roed. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 4 +++- mcp-server/index.js | 15 ++++++++++++--- test/bundet-maal.mjs | 22 ++++++++++++++++++++++ 3 files changed, 37 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 02fbf9c2..33d5f92c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -69,7 +69,9 @@ too: one with an end in such a page is refused (13c, 13c2, 13d), and its start p the send gate, the dangerous-button rule, the same single lookup and the recheck under the lock - since the mouse goes down on it and the helper's stop path lets it up in the same place (13a, 13b, 13h, 13i; a guess at «the same element» was measured to be bypassed and to block sliders and text selection, so it was dropped: 13f, 13g, and 13e for an -ordinary drag, still go through). The +ordinary drag, still go through). The send verdict is taken for the app under the start point, also when the +consent is for the riskier app at the other end (a drag from a Send in Chrome to Terminal: 13j), and the recheck under +the lock requires that same app under the start point (13k; start and end swapping owners while it waited). The send gate now knows every browser the helper knows - Chrome Beta, Dev and for Testing, Edge's three channels, Brave Beta and Nightly, Firefox Nightly - compared without case, so a web chat's Send there is judged like in Chrome (`test/claims-offline.mjs` keeps the two lists in step). A web page whose address cannot be read - in any app, since the address rule applies diff --git a/mcp-server/index.js b/mcp-server/index.js index 1b690376..25ad0832 100644 --- a/mcp-server/index.js +++ b/mcp-server/index.js @@ -2060,7 +2060,11 @@ async function haandterKald(request) { return errorResult(`Refused: ${name === 'computer_drag' ? 'a point of that drag' : 'that point'} is inside ${kendt ? 'a password manager page' : 'a page that could not be ruled out as a password manager page'} (${koordinatOpslag.app || targetBundleId || 'a browser'}). ` + `Like password manager apps, it is never clicked by an agent. Nothing was done, and nobody was asked; ask the person to do this step with computer_ask_user.`); } - const sende = (effektivTier === TIER.READ || kunLaes) ? null : await sendeDom(name, args, targetBundleId, appKlik, koordinatOpslag); + // ⛔ R12 (Astra, MAALT): samtykkets maal er det FARLIGSTE program under begge ender (fx Terminal), men det er STARTPUNKTET, + // der klikkes paa. Et traek fra en Chrome-Send til Terminal fik derfor ingen sende-dom. Nu doemmer sende-dommen (og dens + // genmaaling) altid startpunktets ejer; samtykket gaelder stadig det farligste program. + const sendeBid = (KLIK_LIG(name) && !args.app && koordinatOpslag?.bundleId) ? koordinatOpslag.bundleId : targetBundleId; + const sende = (effektivTier === TIER.READ || kunLaes) ? null : await sendeDom(name, args, sendeBid, appKlik, koordinatOpslag); if (sende?.afvis) { record({ tool: name, tier: tool.tier, args: scrubArgs(args), mode: currentMode(), target: targetBundleId, decision: 'denied', asked: false, reason: `send port: ${sende.afvis}` }); @@ -2220,6 +2224,11 @@ async function haandterKald(request) { } else if (somMaengde(nu) !== somMaengde(koordinatEjereFoer)) { return `the window under that point changed while the agent waited (was ${koordinatEjereFoer.join(', ')}, now ${nu.join(', ')})`; } + // R12 (Astra, MAALT): ejerne blev sammenlignet som en MAENGDE - byttede start og slut plads, passerede det, og startpunktet + // var nu en Send. Startpunktets ejer skal vaere den samme som ved dommen. + if (koordinatOpslag && nuKoordinat && nuKoordinat.bundleId !== koordinatOpslag.bundleId) { + return `the app under the start point changed while the agent waited (was ${koordinatOpslag.bundleId}, now ${nuKoordinat.bundleId})`; + } // R9d/R10: et punkt der er blevet en adgangskode-side, mens der blev ventet, klikkes aldrig paa et ja til noget andet. if (koordinatOpslag && nuKoordinat?.password_page) { return 'the point is now inside a password manager page, or one that could not be ruled out, which is never clicked by an agent - ask the person to do this step with computer_ask_user'; @@ -2255,14 +2264,14 @@ async function haandterKald(request) { ? 'the point is now inside a password manager page, which is never clicked by an agent - ask the person to do this step with computer_ask_user' : 'what is under that point could no longer be ruled out as a password manager page, so it is not clicked by an agent - ask the person to do this step with computer_ask_user'; } - if (beskedSlags(targetBundleId)) { + if (beskedSlags(sendeBid)) { // R27: et klik med `app` genmaales I maalprogrammet, ligesom det blev doemt. let igenKlik = null; if (appKlik) { try { igenKlik = await callHelper(['at', '--app', appVaerdi(args, targetBundleId), '--x', String(args.x), '--y', String(args.y)], { timeout: 8000 }); } catch {} if (!igenKlik?.found || igenKlik.window_number !== appKlik.window_number) return 'the window under that point in the app changed while the agent waited'; } - const igen = await sendeDom(name, args, targetBundleId, igenKlik, nuKoordinat); + const igen = await sendeDom(name, args, sendeBid, igenKlik, nuKoordinat); if (JSON.stringify(igen ?? null) !== JSON.stringify(sende ?? null)) { return 'what would be sent changed after the person approved it - who it goes to or what it says - so it was not sent'; } diff --git a/test/bundet-maal.mjs b/test/bundet-maal.mjs index 74afeb44..b9a6c6e9 100644 --- a/test/bundet-maal.mjs +++ b/test/bundet-maal.mjs @@ -540,6 +540,28 @@ for (const [nr, tekst, args, rolle] of [ srv.kill(); } } +// 13j-13k · R12 (Astra, MAALT): samtykkets maal er det farligste program under BEGGE ender, men startpunktet er det der klikkes. +// 13j: et traek fra en Chrome-Send til Terminal - personen siger ja til Terminal - maa ikke slippe uden om sende-dommen. +// 13k: start og slut bytter ejer under ventetiden (maengden er den samme) - startpunktet er nu en Send. +{ + const SEND = { found: true, app: 'Google Chrome', bundleId: 'com.google.Chrome', pid: 400, role: 'AXButton', title: 'Send', description: '', window: 'WhatsApp', frame: { x: 400, y: 600, w: 40, h: 30 }, under: ['com.google.Chrome'] }; + const TERM = { found: true, app: 'Terminal', bundleId: 'com.apple.Terminal', pid: 500, role: 'AXTextArea', title: '', description: '', window: 'zsh', frame: { x: 0, y: 0, w: 600, h: 400 }, under: ['com.apple.Terminal'] }; + const FIND = { found: true, app: 'Finder', bundleId: 'com.apple.finder', pid: 300, role: 'AXGroup', title: '', description: '', window: 'Dokumenter', frame: { x: 0, y: 0, w: 600, h: 400 }, under: ['com.apple.finder'] }; + const APPS = { apps: [{ name: 'Google Chrome', bundleId: 'com.google.Chrome', pid: 400, active: false }, { name: 'Terminal', bundleId: 'com.apple.Terminal', pid: 500, active: false }, + { name: 'Finder', bundleId: 'com.apple.finder', pid: 300, active: true }] }; + for (const [id, hvad, raekke, tekst] of [ + ['13j', 'traek fra en Chrome-Send til Terminal: sende-dommen gaelder startpunktet, ogsaa naar personen siger ja til Terminal', [SEND, TERM, SEND, TERM], /Send control|Nothing was sent|not sent/], + ['13k', 'start og slut bytter ejer under ventetiden (Finder -> Chrome-Send): afvist, intet traek', [FIND, SEND, SEND, FIND], /start point changed/], + ]) { + const sp = lavFalskSpoerger('ja', 'cmcp-bundet-traek2'); + const { srv, rpc, kald, hj } = klient({ apps: APPS, at: { _raekke: raekke }, samtale: { window: 'WhatsApp' } }, { CMCP_BACKGROUND: '0', CMCP_OSASCRIPT: sp.sti }); + await rpc('initialize', { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'bundet', version: '1' } }); + const r = await kald('computer_drag', { fromX: 410, fromY: 610, toX: 100, toY: 100 }); + const traek = hj.kald().filter(k => k.argv[0] === 'drag'); + check(`${id} ${hvad}`, traek.length === 0 && r.fejl && tekst.test(r.tekst), `traek ${traek.length} · spurgt ${sp.gangeSpurgt()} · ` + r.tekst.slice(0, 160)); + srv.kill(); + } +} // 12m · R11 (Astra, mutant S): et klik uden app doemmes paa ÉT opslag - sende-dommen og knapErFarlig genbruger ejerens. // Et almindeligt klik i en browser giver derfor praecis to `at`: dommen og genmaalingen under laasen. { From ef42a8d1e057c8dad9b11004c6dd5d45131a5ea6 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Thu, 5 Nov 2026 15:42:30 +0100 Subject: [PATCH 65/94] R13 efter Astra R12 Q2: farlig-knap-dommen gentages under laasen paa det genmaalte punkt (klik og traek) 13l/13m/13n: OK ved dommen og Delete lige foer handlingen klikkes/traekkes ikke (13n med app, kun de to at --app). 13o kalibrerer: uaendret OK klikkes. Mutant (tjekket slaaet fra) -> 13l, 13m, 13n roede. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 2 ++ mcp-server/index.js | 11 ++++++++++- test/bundet-maal.mjs | 32 ++++++++++++++++++++++++++++++++ 3 files changed, 44 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 33d5f92c..c64820db 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -72,6 +72,8 @@ was measured to be bypassed and to block sliders and text selection, so it was d ordinary drag, still go through). The send verdict is taken for the app under the start point, also when the consent is for the riskier app at the other end (a drag from a Send in Chrome to Terminal: 13j), and the recheck under the lock requires that same app under the start point (13k; start and end swapping owners while it waited). The +dangerous-button rule is taken again on the rechecked point too, for clicks and drags: OK when judged and Delete just +before acting is not clicked (13l, 13m, 13n with an app; 13o, an unchanged OK, still goes through). The send gate now knows every browser the helper knows - Chrome Beta, Dev and for Testing, Edge's three channels, Brave Beta and Nightly, Firefox Nightly - compared without case, so a web chat's Send there is judged like in Chrome (`test/claims-offline.mjs` keeps the two lists in step). A web page whose address cannot be read - in any app, since the address rule applies diff --git a/mcp-server/index.js b/mcp-server/index.js index 25ad0832..a0ec4939 100644 --- a/mcp-server/index.js +++ b/mcp-server/index.js @@ -2255,8 +2255,8 @@ async function haandterKald(request) { // ⛔ R6 (Astra, MAALT i hukommelsen): adgangskode-genkontrollen laa INDE i beskedSlags - serverens browserliste er // kortere end hjaelperens (Chrome Beta, Chrome for Testing, Firefox Nightly gik uden genkontrol). Nu for ALLE // app-klik: skiftede punktet til en adgangskode-side, mens der blev ventet, klikkes der ikke. + let nuKlik = null; if (appKlik && name === 'computer_click') { - let nuKlik = null; try { nuKlik = await callHelper(['at', '--app', appVaerdi(args, targetBundleId), '--x', String(args.x), '--y', String(args.y)], { timeout: 8000 }); } catch {} if (!nuKlik?.found) return 'what is under that point could not be checked again just before the click'; // R8 (Opus O6): kun en GENKENDT side kaldes en adgangskode-side; en der ikke kunne afgoeres, siges som det den er. @@ -2276,6 +2276,15 @@ async function haandterKald(request) { return 'what would be sent changed after the person approved it - who it goes to or what it says - so it was not sent'; } } + // R13 (Astra R12, MAALT): farlig-knap-dommen blev kun taget foer ventetiden. Var punktet «OK» ved dommen (intet + // spoergsmaal, eller et ja til et almindeligt klik) og «Delete» under laasen, blev der klikket. Nu doemmes knappen + // igen paa det GENMAALTE punkt (intet nyt opslag): er den blevet farlig, klikkes der ikke. + if (KLIK_LIG(name) && !knapFarlig && effektivTier !== TIER.READ && !kunLaes) { + const igenPunkt = appKlik ? nuKlik : (!args.app ? nuKoordinat : null); + if (igenPunkt && await knapErFarlig(name, args, igenPunkt)) { + return 'what is under that point became a button that can delete, send or pay while the agent waited, which is not what was approved - nothing was done'; + } + } // ⛔ B5 (29/9, panelet): med laant skaerm TAGER agenten ikke skaermen fra et // menneske der bruger den. Input efter vores egen sidste handling er et // menneske (vores egne tastetryk taeller ikke) - saa venter agenten. diff --git a/test/bundet-maal.mjs b/test/bundet-maal.mjs index b9a6c6e9..193d5b5f 100644 --- a/test/bundet-maal.mjs +++ b/test/bundet-maal.mjs @@ -562,6 +562,38 @@ for (const [nr, tekst, args, rolle] of [ srv.kill(); } } +// 13l-13n · R13 (Astra R12, MAALT): farlig-knap-dommen gentages under laasen paa det genmaalte punkt. «OK» ved dommen og +// «Delete» lige foer handlingen: intet klik/traek. 13o kalibrerer: et uaendret «OK» klikkes stadig. +{ + const OKF = { found: true, app: 'Finder', bundleId: 'com.apple.finder', pid: 300, role: 'AXButton', title: 'OK', description: '', window: 'Dokumenter', frame: { x: 0, y: 0, w: 60, h: 30 }, under: ['com.apple.finder'] }; + const DELF = { ...OKF, title: 'Delete' }; + const FLADE = { ...OKF, role: 'AXGroup', title: '' }; + const APPSF = { apps: [{ name: 'Finder', bundleId: 'com.apple.finder', pid: 300, active: true }] }; + for (const [id, hvad, vaerktoej, raekke, skal] of [ + ['13l', 'klik uden app: OK ved dommen, Delete under laasen - intet klik', 'computer_click', [OKF, DELF], false], + ['13m', 'traek: startpunktet OK ved dommen, Delete under laasen - intet traek', 'computer_drag', [OKF, FLADE, DELF, FLADE], false], + ['13o', 'kalibrering: klik paa et uaendret OK gaar igennem', 'computer_click', [OKF, OKF], true], + ]) { + const sp = lavFalskSpoerger('ja', 'cmcp-bundet-knap'); + const { srv, rpc, kald, hj } = klient({ apps: APPSF, at: { _raekke: raekke } }, { CMCP_BACKGROUND: '0', CMCP_OSASCRIPT: sp.sti }); + await rpc('initialize', { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'bundet', version: '1' } }); + const r = await kald(vaerktoej, vaerktoej === 'computer_drag' ? { fromX: 10, fromY: 10, toX: 300, toY: 300 } : { x: 10, y: 10 }); + const handling = hj.kald().filter(k => k.argv[0] === (vaerktoej === 'computer_drag' ? 'drag' : 'click')); + const ok = skal ? handling.length === 1 : (handling.length === 0 && r.fejl && /became a button that can delete/.test(r.tekst)); + check(`${id} ${hvad}`, ok, `handling ${handling.length} · spurgt ${sp.gangeSpurgt()} · ` + r.tekst.slice(0, 160)); + srv.kill(); + } + // 13n: med app (Notes) - genkontrollens «at --app» genbruges, intet tredje opslag. + const OK = { found: true, app: 'Notes', bundleId: 'com.apple.Notes', pid: 3303, role: 'AXButton', title: 'OK', description: '', window: 'Note', window_number: 777, under: ['com.apple.finder'] }; + const { srv, rpc, kald, hj } = klient({ apps: APPS8, at: OK, 'at --app': { _raekke: [OK, { ...OK, title: 'Delete' }] } }); + await rpc('initialize', { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'bundet', version: '1' } }); + const r = await kald('computer_click', { app: 'Notes', x: 10, y: 20 }); + const klik = hj.kald().filter(k => k.argv[0] === 'click'); + const atApp = hj.kald().filter(k => k.argv[0] === 'at' && k.argv.includes('--app')); + check('13n klik med app (Notes): OK ved dommen, Delete under laasen - intet klik, og kun de to «at --app»', + klik.length === 0 && r.fejl && /became a button that can delete/.test(r.tekst) && atApp.length === 2, `klik ${klik.length} · at --app ${atApp.length} · ` + r.tekst.slice(0, 160)); + srv.kill(); +} // 12m · R11 (Astra, mutant S): et klik uden app doemmes paa ÉT opslag - sende-dommen og knapErFarlig genbruger ejerens. // Et almindeligt klik i en browser giver derfor praecis to `at`: dommen og genmaalingen under laasen. { From 656a45e7eb6c2ce52aabe2be38ed64e7e73a88c6 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Thu, 5 Nov 2026 15:59:16 +0100 Subject: [PATCH 66/94] 13p (Opus R12): et traek i en browser doemmes paa praecis fire opslag - mutanten med traek-eget-opslag er nu roed Co-Authored-By: Claude Opus 5.5 --- test/bundet-maal.mjs | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/test/bundet-maal.mjs b/test/bundet-maal.mjs index 193d5b5f..49b7d2f8 100644 --- a/test/bundet-maal.mjs +++ b/test/bundet-maal.mjs @@ -607,6 +607,19 @@ for (const [nr, tekst, args, rolle] of [ klik.length === 1 && at.length === 2, `at ${at.length} · klik ${klik.length} · ` + r.tekst.slice(0, 100)); srv.kill(); } +// 13p · R13 (Opus R12, mutant «sende-dommen laver sit eget opslag KUN ved traek» overlevede alle 72): et traek i en browser +// doemmes paa startpunktets ene opslag + slutpunktets - praecis fire `at`: to til dommen, to til genmaalingen. +{ + const O = { found: true, app: 'Google Chrome', bundleId: 'com.google.Chrome', pid: 400, role: 'AXButton', title: 'OK', description: '', window: 'Dokument', frame: { x: 0, y: 0, w: 120, h: 30 }, under: ['com.google.Chrome'] }; + const { srv, rpc, kald, hj } = klient({ apps: { apps: [{ name: 'Google Chrome', bundleId: 'com.google.Chrome', pid: 400, active: false }, { name: 'Finder', bundleId: 'com.apple.finder', pid: 300, active: true }] }, + at: O, samtale: { window: 'Dokument' } }, { CMCP_BACKGROUND: '0' }); + await rpc('initialize', { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'bundet', version: '1' } }); + const r = await kald('computer_drag', { fromX: 10, fromY: 20, toX: 60, toY: 20 }); + const at = hj.kald().filter(k => k.argv[0] === 'at'), traek = hj.kald().filter(k => k.argv[0] === 'drag'); + check('13p traek uden app i en browser: to opslag til dommen + to til genmaalingen (sende-dommen genbruger startpunktets)', + traek.length === 1 && at.length === 4, `at ${at.length} · traek ${traek.length} · ` + r.tekst.slice(0, 100)); + srv.kill(); +} console.log(fails.length ? `DUMPET: ${fails.length} tjek` : 'Alle tjek bestået.'); process.exit(fails.length ? 1 : 0); From 8d0f8d910220f8de658b3bcf24c4e8ed62cb02a6 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Thu, 5 Nov 2026 16:49:44 +0100 Subject: [PATCH 67/94] R14 efter R13 (Astra + Opus): farlig-knap doemmes paa HVERT genmaalt opslag; genmaalingens sende-dom holdt af proever; spoergsmaalet naevner begge programmer MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 13q/13r: klik med app i en browser [OK, OK, Delete] afvises (dommen brugte det aeldste genmaalte opslag). 13s/13t: Opus' overlevende mutanter M6 (ejer-tjek kun ved traek), M8 og M9 (genmaaling paa targetBundleId) er nu roede. 13u: et traek fra en Send til 1Password naevner 1Password i spoergsmaalet. Afvisningsteksten siger «changed ... or whose name can no longer be read» (Opus N12). Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 10 +++++--- mcp-server/index.js | 17 ++++++++++---- test/bundet-maal.mjs | 56 ++++++++++++++++++++++++++++++++++++++++++-- 3 files changed, 73 insertions(+), 10 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c64820db..ab01d105 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -71,9 +71,13 @@ down on it and the helper's stop path lets it up in the same place (13a, 13b, 13 was measured to be bypassed and to block sliders and text selection, so it was dropped: 13f, 13g, and 13e for an ordinary drag, still go through). The send verdict is taken for the app under the start point, also when the consent is for the riskier app at the other end (a drag from a Send in Chrome to Terminal: 13j), and the recheck under -the lock requires that same app under the start point (13k; start and end swapping owners while it waited). The -dangerous-button rule is taken again on the rechecked point too, for clicks and drags: OK when judged and Delete just -before acting is not clicked (13l, 13m, 13n with an app; 13o, an unchanged OK, still goes through). The +the lock requires that same app under the start point (13k; start and end swapping owners while it waited; 13s for a +click; 13t for a drag whose start becomes a Send under the lock). When the consent is for another app than the one the +message is sent from, the question names both (13u: a drag from a Send to 1Password). The +dangerous-button rule is taken again on every lookup made under the lock, for clicks and drags: OK when judged and +Delete at any recheck is not clicked (13l, 13m; 13n with an app; 13q in a browser with an app, where the point is looked +up twice; 13o and 13r, an unchanged OK, still go through). A button that turns dangerous AFTER the last lookup is not +caught - nothing can see that without clicking. The send gate now knows every browser the helper knows - Chrome Beta, Dev and for Testing, Edge's three channels, Brave Beta and Nightly, Firefox Nightly - compared without case, so a web chat's Send there is judged like in Chrome (`test/claims-offline.mjs` keeps the two lists in step). A web page whose address cannot be read - in any app, since the address rule applies diff --git a/mcp-server/index.js b/mcp-server/index.js index a0ec4939..b069d86a 100644 --- a/mcp-server/index.js +++ b/mcp-server/index.js @@ -2094,7 +2094,10 @@ async function haandterKald(request) { // og der stod ingen sti. Man godkendte i blinde. // `describe` viser stien og knappen, og laekker IKKE skrevet tekst // («Type 11 characters»). Status og koe beholder den korte tekst. - tier: effektivTier, targetBundleId, describe: sende?.describe || describe(name, args), + tier: effektivTier, targetBundleId, + // R14 (Opus R13 N4, MAALT): doemmes sendingen paa startpunktets program, mens spoergsmaalet gaelder et andet (fx et traek + // fra en Send til 1Password), skal personen se BEGGE - ellers stod 1Password ingen steder i spoergsmaalet. + describe: sende?.describe ? (sendeBid && targetBundleId && sendeBid !== targetBundleId ? `${sende.describe} It also reaches ${targetBundleId}.` : sende.describe) : describe(name, args), ikon: { session: SESSION, client: server.getClientVersion?.()?.name || process.env.CMCP_CLIENT || null }, aldrigViaIkonet: usloeretBillede, // Et menupunkt der ser ud til at slette noget, spoerger hver gang - @@ -2264,9 +2267,9 @@ async function haandterKald(request) { ? 'the point is now inside a password manager page, which is never clicked by an agent - ask the person to do this step with computer_ask_user' : 'what is under that point could no longer be ruled out as a password manager page, so it is not clicked by an agent - ask the person to do this step with computer_ask_user'; } + let igenKlik = null; if (beskedSlags(sendeBid)) { // R27: et klik med `app` genmaales I maalprogrammet, ligesom det blev doemt. - let igenKlik = null; if (appKlik) { try { igenKlik = await callHelper(['at', '--app', appVaerdi(args, targetBundleId), '--x', String(args.x), '--y', String(args.y)], { timeout: 8000 }); } catch {} if (!igenKlik?.found || igenKlik.window_number !== appKlik.window_number) return 'the window under that point in the app changed while the agent waited'; @@ -2279,10 +2282,14 @@ async function haandterKald(request) { // R13 (Astra R12, MAALT): farlig-knap-dommen blev kun taget foer ventetiden. Var punktet «OK» ved dommen (intet // spoergsmaal, eller et ja til et almindeligt klik) og «Delete» under laasen, blev der klikket. Nu doemmes knappen // igen paa det GENMAALTE punkt (intet nyt opslag): er den blevet farlig, klikkes der ikke. + // R14 (Astra R13-3, MAALT): med app i en browser slaas punktet op TO gange under laasen (adgangskode- og sende-genkontrollen); + // dommen brugte det foerste, saa [OK, OK, Delete] klikkede. Nu doemmes HVERT genmaalt opslag - er et af dem farligt, klikkes der ikke. if (KLIK_LIG(name) && !knapFarlig && effektivTier !== TIER.READ && !kunLaes) { - const igenPunkt = appKlik ? nuKlik : (!args.app ? nuKoordinat : null); - if (igenPunkt && await knapErFarlig(name, args, igenPunkt)) { - return 'what is under that point became a button that can delete, send or pay while the agent waited, which is not what was approved - nothing was done'; + const igenPunkter = appKlik ? [nuKlik, igenKlik].filter(Boolean) : (!args.app && nuKoordinat ? [nuKoordinat] : []); + let blevFarlig = false; + for (const igenPunkt of igenPunkter) if (await knapErFarlig(name, args, igenPunkt)) { blevFarlig = true; break; } + if (blevFarlig) { + return 'what is under that point changed while the agent waited into something that can delete, send or pay, or whose name can no longer be read - that is not what was approved, so nothing was done'; } } // ⛔ B5 (29/9, panelet): med laant skaerm TAGER agenten ikke skaermen fra et diff --git a/test/bundet-maal.mjs b/test/bundet-maal.mjs index 49b7d2f8..22f56181 100644 --- a/test/bundet-maal.mjs +++ b/test/bundet-maal.mjs @@ -579,7 +579,7 @@ for (const [nr, tekst, args, rolle] of [ await rpc('initialize', { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'bundet', version: '1' } }); const r = await kald(vaerktoej, vaerktoej === 'computer_drag' ? { fromX: 10, fromY: 10, toX: 300, toY: 300 } : { x: 10, y: 10 }); const handling = hj.kald().filter(k => k.argv[0] === (vaerktoej === 'computer_drag' ? 'drag' : 'click')); - const ok = skal ? handling.length === 1 : (handling.length === 0 && r.fejl && /became a button that can delete/.test(r.tekst)); + const ok = skal ? handling.length === 1 : (handling.length === 0 && r.fejl && /changed while the agent waited into something that can delete/.test(r.tekst)); check(`${id} ${hvad}`, ok, `handling ${handling.length} · spurgt ${sp.gangeSpurgt()} · ` + r.tekst.slice(0, 160)); srv.kill(); } @@ -591,9 +591,61 @@ for (const [nr, tekst, args, rolle] of [ const klik = hj.kald().filter(k => k.argv[0] === 'click'); const atApp = hj.kald().filter(k => k.argv[0] === 'at' && k.argv.includes('--app')); check('13n klik med app (Notes): OK ved dommen, Delete under laasen - intet klik, og kun de to «at --app»', - klik.length === 0 && r.fejl && /became a button that can delete/.test(r.tekst) && atApp.length === 2, `klik ${klik.length} · at --app ${atApp.length} · ` + r.tekst.slice(0, 160)); + klik.length === 0 && r.fejl && /changed while the agent waited into something that can delete/.test(r.tekst) && atApp.length === 2, `klik ${klik.length} · at --app ${atApp.length} · ` + r.tekst.slice(0, 160)); srv.kill(); } +// 13q · R14 (Astra R13-3, MAALT): med app i en BROWSER slaas punktet op to gange under laasen (adgangskode- og sende-genkontrol). +// [OK ved dommen, OK, Delete] skal afvises - dommen maa ikke bruge det aeldste genmaalte opslag. 13r kalibrerer: [OK, OK, OK] klikkes. +{ + const OKC = { found: true, app: 'Google Chrome', bundleId: 'com.google.Chrome', pid: 400, role: 'AXButton', title: 'OK', description: '', window: 'Dokument', window_number: 901, frame: { x: 0, y: 0, w: 60, h: 30 }, under: ['com.google.Chrome'] }; + const APPSC = { apps: [{ name: 'Google Chrome', bundleId: 'com.google.Chrome', pid: 400, active: false }, { name: 'Finder', bundleId: 'com.apple.finder', pid: 300, active: true }] }; + for (const [id, hvad, raekke, skal] of [ + ['13q', 'klik med app i Chrome: OK ved dommen, OK ved adgangskode-genkontrollen, Delete ved sende-genkontrollen - intet klik', [OKC, OKC, { ...OKC, title: 'Delete' }], false], + ['13r', 'kalibrering: klik med app i Chrome paa et uaendret OK gaar igennem (tre opslag)', [OKC, OKC, OKC], true], + ]) { + const { srv, rpc, kald, hj } = klient({ apps: APPSC, at: OKC, 'at --app': { _raekke: raekke }, samtale: { window: 'Dokument' } }); + await rpc('initialize', { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'bundet', version: '1' } }); + const r = await kald('computer_click', { app: 'Google Chrome', x: 10, y: 20 }); + const klik = hj.kald().filter(k => k.argv[0] === 'click'); + const atApp = hj.kald().filter(k => k.argv[0] === 'at' && k.argv.includes('--app')); + const ok = skal ? (klik.length === 1 && atApp.length === 3) : (klik.length === 0 && r.fejl && /changed while the agent waited into something that can delete/.test(r.tekst) && atApp.length === 3); + check(`${id} ${hvad}`, ok, `klik ${klik.length} · at --app ${atApp.length} · ` + r.tekst.slice(0, 160)); + srv.kill(); + } +} +// 13s-13u · R14 (Opus R13, MAALT): genmaalingens halvdel af sende-dommen holdes nu af en proeve (mutanterne M6 «ejer-tjek kun ved +// traek», M8 «beskedSlags(targetBundleId)» og M9 «genmaalingens dom paa targetBundleId» overlevede alle 79), og +// spoergsmaalet ved et traek fra en Send til 1Password naevner 1Password. +{ + const CH = 'com.google.Chrome', FI = 'com.apple.finder', TB = 'com.apple.Terminal', OPB = 'com.1password.1password'; + const mk = (bid, o) => ({ found: true, app: 'X', bundleId: bid, pid: 400, role: '', title: '', description: '', window: '', frame: { x: 0, y: 0, w: 80, h: 32 }, under: [bid], ...o }); + const SEND = mk(CH, { role: 'AXButton', title: 'Send', window: 'WhatsApp', frame: { x: 290, y: 44, w: 40, h: 30 } }); + const TERM = mk(TB, { role: 'AXTextArea', window: 'zsh', frame: { x: 500, y: 0, w: 400, h: 300 } }); + const OP = mk(OPB, { role: 'AXGroup', window: '1Password', frame: { x: 500, y: 0, w: 400, h: 300 } }); + const OKD = mk(CH, { role: 'AXButton', title: 'OK', window: 'Dokument' }); + const FIND = mk(FI, { role: 'AXGroup', window: 'Dokumenter', frame: { x: 0, y: 0, w: 600, h: 400 } }); + const CHAT = { window: 'WhatsApp', headings: ['Mor'], column: true, field: { role: 'AXTextArea', value: 'hej', frame: { x: 0, y: 40, w: 280, h: 40 } } }; + const apps = (...bids) => ({ apps: [...bids.map((b, i) => ({ name: b.split('.').pop(), bundleId: b, pid: 400 + i, active: false })), { name: 'Finder', bundleId: FI, pid: 300, active: true }] }); + for (const [id, hvad, svar, vaerktoej, args, dom] of [ + ['13s', 'klik uden app: Finder (under Finder, Chrome) ved dommen, Chrome-Send (under Chrome, Finder) under laasen - intet klik', + { apps: apps(CH), at: { _raekke: [{ ...FIND, under: [FI, CH] }, { ...SEND, under: [CH, FI] }] }, samtale: CHAT, idle: { idle: 600 } }, + 'computer_click', { x: 300, y: 50 }, ({ handl, r }) => handl === 0 && /start point changed/.test(r.tekst)], + ['13t', 'traek Chrome-OK («Dokument») -> Terminal, ja til Terminal; under laasen er startpunktet en WhatsApp-Send - intet traek', + { apps: apps(CH, TB), at: { _raekke: [OKD, TERM, SEND, TERM] }, samtale: { _raekke: [{ window: 'Dokument' }, { window: 'Dokument' }, CHAT, CHAT, CHAT] }, idle: { idle: 600 } }, + 'computer_drag', { fromX: 300, fromY: 50, toX: 600, toY: 100, holdMs: 0 }, ({ handl }) => handl === 0], + ['13u', 'traek Chrome-Send -> 1Password i forgrunden: spoergsmaalet naevner baade sendingen og 1Password', + { apps: apps(CH, OPB), at: { _raekke: [SEND, OP, SEND, OP] }, samtale: CHAT, idle: { idle: 600 } }, + 'computer_drag', { fromX: 300, fromY: 50, toX: 600, toY: 100, holdMs: 0 }, ({ sp }) => sp.some(t => /1password/i.test(t) && /Mor/.test(t) && /hej/.test(t))], + ]) { + const sp = lavFalskSpoerger('ja', 'cmcp-bundet-r14'); + const { srv, rpc, kald, hj } = klient(svar, { CMCP_BACKGROUND: '0', CMCP_OSASCRIPT: sp.sti }); + await rpc('initialize', { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'bundet', version: '1' } }); + const r = await kald(vaerktoej, args); + const handl = hj.kald().filter(k => ['click', 'drag'].includes(k.argv[0])).length; + check(`${id} ${hvad}`, dom({ handl, r, sp: sp.tekster() }), `handlinger ${handl} · spurgt ${sp.gangeSpurgt()} · ` + r.tekst.slice(0, 140) + ' · ' + sp.tekster().map(t => t.replace(/\s+/g, ' ').slice(0, 160)).join(' | ')); + srv.kill(); + } +} // 12m · R11 (Astra, mutant S): et klik uden app doemmes paa ÉT opslag - sende-dommen og knapErFarlig genbruger ejerens. // Et almindeligt klik i en browser giver derfor praecis to `at`: dommen og genmaalingen under laasen. { From c3438b89fe4d47d7571a9e2cccf67cbcd22d601d Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Thu, 5 Nov 2026 16:52:26 +0100 Subject: [PATCH 68/94] =?UTF-8?q?chrome-vault-live=20tjek=204:=20proev=20k?= =?UTF-8?q?un=20=C2=ABsearch-incomplete=C2=BB=20igen=20(hoejst=205x,=203?= =?UTF-8?q?=20s)=20-=20personens=20egne=20Chrome-vinduer=20bygger=20stadig?= =?UTF-8?q?=20deres=20trae?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Kvitteringen 1105-162257 blev roed paa netop det (runde 2 groen); kravet til det endelige svar er uaendret. Co-Authored-By: Claude Opus 5.5 --- test/chrome-vault-live.mjs | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/test/chrome-vault-live.mjs b/test/chrome-vault-live.mjs index 3ff9ebb8..b9670fb8 100644 --- a/test/chrome-vault-live.mjs +++ b/test/chrome-vault-live.mjs @@ -110,10 +110,17 @@ try { // 4-5. R9 (A6): et tryk og en ventetid paa sidens egne markoerer finder intet - og SIGER at en adgangskode-side blev sprunget // over, saa agenten ikke leder videre i ring. (Hjaelperen svarer exit 1 paa et afslag; svaret laeses fra stdout.) const afslag = (args) => { try { return hj(args); } catch (e) { try { return JSON.parse(e.stdout || '{}'); } catch { return {}; } } }; - const p4 = afslag(['press', '--app', 'com.google.Chrome', '--contains', `${I}-TEKST`, '--depth', '60', '--dry']); + // R14 (kvittering 1105-162257, MAALT): `--app com.google.Chrome` soeger ogsaa i personens EGNE Chrome-vinduer, hvis trae bygges + // 3-15 s efter kontakten taendes - en ulaeselig del giver «search-incomplete» foer «not-found». Kun DET svar proeves igen + // (hoejst 5 gange, 3 s imellem); kravet til det endelige svar er uaendret, og antallet af forsoeg staar i udskriften. + let p4 = afslag(['press', '--app', 'com.google.Chrome', '--contains', `${I}-TEKST`, '--depth', '60', '--dry']), forsoeg4 = 1; + while (p4.code === 'search-incomplete' && forsoeg4 < 5) { + await new Promise(r => setTimeout(r, 3000)); forsoeg4++; + p4 = afslag(['press', '--app', 'com.google.Chrome', '--contains', `${I}-TEKST`, '--depth', '60', '--dry']); + } check('4. press paa sidens tekst: intet fundet, og svaret siger at en adgangskode-side blev sprunget over', p4.ok === false && p4.code === 'not-found' && (p4.skipped_password_pages || []).some(SPRUNGET), - JSON.stringify(p4).slice(0, 200)); + `forsoeg ${forsoeg4} · ` + JSON.stringify(p4).slice(0, 200)); const w5 = afslag(['wait-for', '--app', 'com.google.Chrome', '--contains', `${I}-TEKST`, '--depth', '60', '--timeout', '2']); check('5. wait-for paa sidens tekst: tidsudloeb, og svaret siger at en adgangskode-side ikke blev gennemsoegt', w5.ok === false && w5.code === 'wait-timeout' && (w5.skipped_password_pages || []).some(SPRUNGET), From 205cd373f99ed36a7907051841524d2155855040 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Fri, 6 Nov 2026 10:19:51 +0100 Subject: [PATCH 69/94] =?UTF-8?q?Foer=20npm=20(Opus=20R14):=2013v=20[OK,?= =?UTF-8?q?=20Delete,=20OK]=20afvises=20-=20mutanten=20=C2=ABkun=20sidste?= =?UTF-8?q?=20opslag=C2=BB=20er=20nu=20roed;=20vault-proevens=20tjek=204?= =?UTF-8?q?=20skriver=20forsoegstallet=20ogsaa=20ved=20OK?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 5.5 --- test/bundet-maal.mjs | 2 ++ test/chrome-vault-live.mjs | 1 + 2 files changed, 3 insertions(+) diff --git a/test/bundet-maal.mjs b/test/bundet-maal.mjs index 22f56181..5c959025 100644 --- a/test/bundet-maal.mjs +++ b/test/bundet-maal.mjs @@ -601,6 +601,8 @@ for (const [nr, tekst, args, rolle] of [ const APPSC = { apps: [{ name: 'Google Chrome', bundleId: 'com.google.Chrome', pid: 400, active: false }, { name: 'Finder', bundleId: 'com.apple.finder', pid: 300, active: true }] }; for (const [id, hvad, raekke, skal] of [ ['13q', 'klik med app i Chrome: OK ved dommen, OK ved adgangskode-genkontrollen, Delete ved sende-genkontrollen - intet klik', [OKC, OKC, { ...OKC, title: 'Delete' }], false], + // 13v · Opus R14 N16 (mutant S1 «kun sidste opslag» overlevede): Delete i FOERSTE genmaalte opslag, OK i det sidste - afvises. + ['13v', 'klik med app i Chrome: OK ved dommen, Delete ved adgangskode-genkontrollen, OK ved sende-genkontrollen - intet klik', [OKC, { ...OKC, title: 'Delete' }, OKC], false], ['13r', 'kalibrering: klik med app i Chrome paa et uaendret OK gaar igennem (tre opslag)', [OKC, OKC, OKC], true], ]) { const { srv, rpc, kald, hj } = klient({ apps: APPSC, at: OKC, 'at --app': { _raekke: raekke }, samtale: { window: 'Dokument' } }); diff --git a/test/chrome-vault-live.mjs b/test/chrome-vault-live.mjs index b9670fb8..44060d8a 100644 --- a/test/chrome-vault-live.mjs +++ b/test/chrome-vault-live.mjs @@ -118,6 +118,7 @@ try { await new Promise(r => setTimeout(r, 3000)); forsoeg4++; p4 = afslag(['press', '--app', 'com.google.Chrome', '--contains', `${I}-TEKST`, '--depth', '60', '--dry']); } + console.log(` (tjek 4: ${forsoeg4} forsoeg${forsoeg4 > 1 ? ' - de foerste svarede search-incomplete' : ''})`); // Opus R14: ogsaa ved OK check('4. press paa sidens tekst: intet fundet, og svaret siger at en adgangskode-side blev sprunget over', p4.ok === false && p4.code === 'not-found' && (p4.skipped_password_pages || []).some(SPRUNGET), `forsoeg ${forsoeg4} · ` + JSON.stringify(p4).slice(0, 200)); From 017d3212873e64cb9539a1e49ffd4bbb02fcaef3 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Fri, 6 Nov 2026 10:28:02 +0100 Subject: [PATCH 70/94] Foer npm (Opus R13 N15): en godkendt farlig knap skal vaere den samme under laasen, og spoergsmaalet naevner knappen MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 13w: ja til «Delete», «Erase all» under laasen - intet klik. 13x: uaendret «Delete» klikkes, dialogen naevner «Delete». Mutanter: genmaalingen fjernet -> 13w roed; navnet fjernet fra dialogen -> 13w og 13x roede. 15 suiter groenne. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 5 ++++- mcp-server/index.js | 20 +++++++++++++++++++- test/bundet-maal.mjs | 19 +++++++++++++++++++ 3 files changed, 42 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ab01d105..df5b2c26 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -77,7 +77,10 @@ message is sent from, the question names both (13u: a drag from a Send to 1Passw dangerous-button rule is taken again on every lookup made under the lock, for clicks and drags: OK when judged and Delete at any recheck is not clicked (13l, 13m; 13n with an app; 13q in a browser with an app, where the point is looked up twice; 13o and 13r, an unchanged OK, still go through). A button that turns dangerous AFTER the last lookup is not -caught - nothing can see that without clicking. The +caught - nothing can see that without clicking. A dangerous button the person approved must still be the same +button (name and role) at every lookup under the lock - a yes to «Delete» is not a click on «Erase all» (13w) - and the +question now names it: «Click on screen at 10, 10 - on «Delete» in Finder» (13w, 13x; 13v holds every lookup, not only +the last). The send gate now knows every browser the helper knows - Chrome Beta, Dev and for Testing, Edge's three channels, Brave Beta and Nightly, Firefox Nightly - compared without case, so a web chat's Send there is judged like in Chrome (`test/claims-offline.mjs` keeps the two lists in step). A web page whose address cannot be read - in any app, since the address rule applies diff --git a/mcp-server/index.js b/mcp-server/index.js index b069d86a..2b946474 100644 --- a/mcp-server/index.js +++ b/mcp-server/index.js @@ -684,6 +684,12 @@ async function trykForhaand(args) { const KLIK_LIG = (name) => name === 'computer_click' || name === 'computer_drag'; const klikPunkt = (name, args) => name === 'computer_drag' ? [args.fromX, args.fromY] : [args.x, args.y]; +// Hvordan et element under et klik naevnes for mennesket: titel, ellers beskrivelse, ellers rollen. +function knapNavn(e) { + const n = String(e?.title || e?.description || '').trim(); + return n ? `«${n.slice(0, 80)}»` : `an unnamed ${String(e?.role || 'element').replace(/^AX/, '').toLowerCase()}`; +} + async function knapErFarlig(name, args, appKlik = null, forhaand = null) { const [kx, ky] = klikPunkt(name, args); if (KLIK_LIG(name) && Number.isFinite(kx) && Number.isFinite(ky)) { @@ -2073,6 +2079,8 @@ async function haandterKald(request) { const menuFarlig = name === 'computer_menu' && effektivTier !== TIER.READ && (menuSerFarlig(args.path) || await menuGenvejErFarlig(appArg(args), args.path)); + // Elementet under (start)punktet, som knap-dommen og samtykket gaelder (med app: maalprogrammets eget opslag). + const knapEl = KLIK_LIG(name) ? (appKlik || koordinatOpslag || null) : null; const knapFarlig = effektivTier !== TIER.READ && !kunLaes && ( name === 'computer_press' ? !!trykDom?.farlig : KLIK_LIG(name) ? await knapErFarlig(name, args, appKlik, koordinatOpslag) : false); @@ -2097,7 +2105,9 @@ async function haandterKald(request) { tier: effektivTier, targetBundleId, // R14 (Opus R13 N4, MAALT): doemmes sendingen paa startpunktets program, mens spoergsmaalet gaelder et andet (fx et traek // fra en Send til 1Password), skal personen se BEGGE - ellers stod 1Password ingen steder i spoergsmaalet. - describe: sende?.describe ? (sendeBid && targetBundleId && sendeBid !== targetBundleId ? `${sende.describe} It also reaches ${targetBundleId}.` : sende.describe) : describe(name, args), + describe: sende?.describe ? (sendeBid && targetBundleId && sendeBid !== targetBundleId ? `${sende.describe} It also reaches ${targetBundleId}.` : sende.describe) + // Foer npm (Opus R13 N15, MAALT): et farligt klik sagde kun «Click on screen at 10, 10» - personen saa ikke HVILKEN knap. + : (knapFarlig && knapEl ? `${describe(name, args)} - on ${knapNavn(knapEl)} in ${knapEl.app || knapEl.bundleId || 'an unknown app'}` : describe(name, args)), ikon: { session: SESSION, client: server.getClientVersion?.()?.name || process.env.CMCP_CLIENT || null }, aldrigViaIkonet: usloeretBillede, // Et menupunkt der ser ud til at slette noget, spoerger hver gang - @@ -2284,6 +2294,14 @@ async function haandterKald(request) { // igen paa det GENMAALTE punkt (intet nyt opslag): er den blevet farlig, klikkes der ikke. // R14 (Astra R13-3, MAALT): med app i en browser slaas punktet op TO gange under laasen (adgangskode- og sende-genkontrollen); // dommen brugte det foerste, saa [OK, OK, Delete] klikkede. Nu doemmes HVERT genmaalt opslag - er et af dem farligt, klikkes der ikke. + // Foer npm (Opus R13 N15, MAALT): et ja til «Delete» klikkede paa «Erase all», naar knappen skiftede under laasen. Var knappen + // farlig og godkendt, skal den samme knap (navn og rolle) staa der i HVERT genmaalt opslag - ellers klikkes der ikke. + if (KLIK_LIG(name) && knapFarlig && knapEl && effektivTier !== TIER.READ && !kunLaes) { + const igenPunkter = appKlik ? [nuKlik, igenKlik].filter(Boolean) : (!args.app && nuKoordinat ? [nuKoordinat] : []); + const id = (e) => JSON.stringify([e?.title || '', e?.description || '', e?.role || '']); + const skiftet = igenPunkter.find(e => id(e) !== id(knapEl)); + if (skiftet) return `the button under that point changed after the person approved it (was ${knapNavn(knapEl)}, now ${knapNavn(skiftet)}), so nothing was done`; + } if (KLIK_LIG(name) && !knapFarlig && effektivTier !== TIER.READ && !kunLaes) { const igenPunkter = appKlik ? [nuKlik, igenKlik].filter(Boolean) : (!args.app && nuKoordinat ? [nuKoordinat] : []); let blevFarlig = false; diff --git a/test/bundet-maal.mjs b/test/bundet-maal.mjs index 5c959025..a88e44d3 100644 --- a/test/bundet-maal.mjs +++ b/test/bundet-maal.mjs @@ -648,6 +648,25 @@ for (const [nr, tekst, args, rolle] of [ srv.kill(); } } +// 13w-13x · foer npm (Opus R13 N15, MAALT): et ja til «Delete» maa ikke blive et klik paa «Erase all», og dialogen naevner knappen. +{ + const DELF = { found: true, app: 'Finder', bundleId: 'com.apple.finder', pid: 300, role: 'AXButton', title: 'Delete', description: '', window: 'Dokumenter', frame: { x: 0, y: 0, w: 60, h: 30 }, under: ['com.apple.finder'] }; + const APPSF = { apps: [{ name: 'Finder', bundleId: 'com.apple.finder', pid: 300, active: true }] }; + for (const [id, hvad, raekke, skal] of [ + ['13w', 'ja til «Delete», men under laasen er knappen «Erase all» - intet klik, og dialogen naevnte «Delete»', [DELF, { ...DELF, title: 'Erase all' }], false], + ['13x', 'kalibrering: ja til et uaendret «Delete» klikkes, og dialogen naevner «Delete»', [DELF, DELF], true], + ]) { + const sp = lavFalskSpoerger('ja', 'cmcp-bundet-n15'); + const { srv, rpc, kald, hj } = klient({ apps: APPSF, at: { _raekke: raekke } }, { CMCP_BACKGROUND: '0', CMCP_OSASCRIPT: sp.sti }); + await rpc('initialize', { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'bundet', version: '1' } }); + const r = await kald('computer_click', { x: 10, y: 10 }); + const klik = hj.kald().filter(k => k.argv[0] === 'click'); + const navngivet = sp.tekster().some(t => /«Delete»/.test(t)); + const ok = skal ? (klik.length === 1 && navngivet) : (klik.length === 0 && r.fejl && /changed after the person approved/.test(r.tekst) && navngivet); + check(`${id} ${hvad}`, ok, `klik ${klik.length} · spurgt ${sp.gangeSpurgt()} · navngivet ${navngivet} · ` + r.tekst.slice(0, 140)); + srv.kill(); + } +} // 12m · R11 (Astra, mutant S): et klik uden app doemmes paa ÉT opslag - sende-dommen og knapErFarlig genbruger ejerens. // Et almindeligt klik i en browser giver derfor praecis to `at`: dommen og genmaalingen under laasen. { From ef475a8be9ced0c5f7eb1bab27ebb182ba2198b4 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Fri, 6 Nov 2026 10:36:23 +0100 Subject: [PATCH 71/94] =?UTF-8?q?Foer=20npm=20(Opus=20R12=20X5):=20et=20na?= =?UTF-8?q?vnloest=20element=20kaldes=20ikke=20=C2=ABthe=20Send=20control?= =?UTF-8?q?=C2=BB=20i=20afvisningen=20(13y;=20mutant=20->=20roed)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 5.5 --- mcp-server/index.js | 6 ++++-- test/bundet-maal.mjs | 17 +++++++++++++++++ 2 files changed, 21 insertions(+), 2 deletions(-) diff --git a/mcp-server/index.js b/mcp-server/index.js index 2b946474..a504e157 100644 --- a/mcp-server/index.js +++ b/mcp-server/index.js @@ -769,7 +769,7 @@ async function sendeDom(name, args, bid, appKlik = null, forhaand = null) { // én kilde, én mutation rammer begge gates' prøver. return klik ? kanVaereKnap(rolle) : (!rolle || /^AX(Button|Image|Group|Unknown|Link)$/.test(String(rolle))); }; - let knapVindue = null, knapRamme = null, erKontrol = false; + let knapVindue = null, knapRamme = null, erKontrol = false, navnloes = false; let sender = false; if (name === 'computer_key') { sender = tastSender(args.combo, slags); @@ -789,6 +789,8 @@ async function sendeDom(name, args, bid, appKlik = null, forhaand = null) { // Intet element, et andet program foran, eller et element UDEN navn: vi ved ikke hvad det er - saa er det en mulig send. sender = (KLIK_LIG(name) && (!k.fundet || k.andetProgram)) || navnSender(k.navne, k.rolle, KLIK_LIG(name)); knapVindue = k.vindue; knapRamme = k.ramme; + // Foer npm (Opus R12 X5): et NAVNLOEST element (fx et billede man traekker ud af en chat) kaldtes «the Send control». + navnloes = !k.fundet || k.andetProgram || !k.navne.filter(Boolean).join(' ').trim(); } } if (!sender) return null; @@ -812,7 +814,7 @@ async function sendeDom(name, args, bid, appKlik = null, forhaand = null) { const sammeRaekke = f && k && k.y < f.y + f.h + 16 && k.y + k.h > f.y - 16 && k.x >= f.x - 16 && k.x <= f.x + f.w + 160; if (!knapVindue || !sam.window || !sammeRaekke) { - return { afvis: 'the Send control could not be tied to the text field whose message would be sent (its window or position could not be read, or it is not next to that field). Nothing was sent. Ask the person to send it themselves.' }; + return { afvis: `${navnloes ? 'what is under that point has no name that rules out a Send control, so it is treated as one - and it' : 'the Send control'} could not be tied to the text field whose message would be sent (its window or position could not be read, or it is not next to that field). Nothing was sent. Ask the person to do this step themselves.` }; } } if (knapVindue && sam.window && knapVindue !== sam.window) { diff --git a/test/bundet-maal.mjs b/test/bundet-maal.mjs index a88e44d3..a1f022fa 100644 --- a/test/bundet-maal.mjs +++ b/test/bundet-maal.mjs @@ -667,6 +667,23 @@ for (const [nr, tekst, args, rolle] of [ srv.kill(); } } +// 13y · foer npm (Opus R12 X5): et NAVNLOEST billede trukket ud af en webchat afvises stadig (det kan vaere en Send), men svaret +// kalder det ikke «the Send control». 13j (en navngiven Send) skal stadig sige «the Send control». +{ + const BILLEDE = { found: true, app: 'Google Chrome', bundleId: 'com.google.Chrome', pid: 400, role: 'AXImage', title: '', description: '', window: 'WhatsApp', frame: { x: 20, y: 300, w: 120, h: 90 }, under: ['com.google.Chrome'] }; + const FIND = { found: true, app: 'Finder', bundleId: 'com.apple.finder', pid: 300, role: 'AXGroup', title: '', description: '', window: 'Dokumenter', frame: { x: 600, y: 0, w: 600, h: 400 }, under: ['com.apple.finder'] }; + const CHAT = { window: 'WhatsApp', headings: ['Mor'], column: true, field: { role: 'AXTextArea', value: 'hej', frame: { x: 0, y: 40, w: 280, h: 40 } } }; + const APPS = { apps: [{ name: 'Google Chrome', bundleId: 'com.google.Chrome', pid: 400, active: false }, { name: 'Finder', bundleId: 'com.apple.finder', pid: 300, active: true }] }; + const sp = lavFalskSpoerger('ja', 'cmcp-bundet-x5'); + const { srv, rpc, kald, hj } = klient({ apps: APPS, at: { _raekke: [BILLEDE, FIND, BILLEDE, FIND] }, samtale: CHAT, idle: { idle: 600 } }, { CMCP_BACKGROUND: '0', CMCP_OSASCRIPT: sp.sti }); + await rpc('initialize', { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'bundet', version: '1' } }); + const r = await kald('computer_drag', { fromX: 60, fromY: 340, toX: 800, toY: 100, holdMs: 0 }); + const traek = hj.kald().filter(k => k.argv[0] === 'drag'); + check('13y navnloest billede ud af en webchat: afvist, og svaret siger at det er NAVNLOEST - ikke «the Send control»', + traek.length === 0 && r.fejl && /has no name that rules out a Send control/.test(r.tekst) && !/the Send control could not/.test(r.tekst), + `traek ${traek.length} · ` + r.tekst.slice(0, 160)); + srv.kill(); +} // 12m · R11 (Astra, mutant S): et klik uden app doemmes paa ÉT opslag - sende-dommen og knapErFarlig genbruger ejerens. // Et almindeligt klik i en browser giver derfor praecis to `at`: dommen og genmaalingen under laasen. { From 08513a246099ca4fad9d5bf3958f14dbf3810a28 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Fri, 6 Nov 2026 11:22:21 +0100 Subject: [PATCH 72/94] Foer npm: B7 (tekst i en knap doemmes som knappen via hjaelperens control), seks browsere i begge lister, search-incomplete naevner sprungne adgangskode-sider, secure-rects siger windows_scanned MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Server: 13z1/13z2 (mutant «forfader ignoreres» -> begge roede). claims-offline: browserlisterne (mutant: Comet fjernet -> roed) og hjaelperens tre nye felter. Hjaelperen er IKKE bygget - kildeaendringerne kraever en ny kandidat, kvittering og panel. Bundle-id'erne er laest i Homebrew cask-data (bevis/browser-ids-2026-11-06), ikke maalt paa en installeret app. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 7 ++++- .../Sources/cmcp-helper/Accessibility.swift | 31 ++++++++++++++++++- helper/Sources/cmcp-helper/main.swift | 15 ++++++--- mcp-server/index.js | 21 +++++++++---- mcp-server/policy.js | 5 ++- test/bundet-maal.mjs | 21 +++++++++++++ test/claims-offline.mjs | 13 ++++++++ 7 files changed, 100 insertions(+), 13 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index df5b2c26..0c9aa2de 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -80,7 +80,12 @@ up twice; 13o and 13r, an unchanged OK, still go through). A button that turns d caught - nothing can see that without clicking. A dangerous button the person approved must still be the same button (name and role) at every lookup under the lock - a yes to «Delete» is not a click on «Erase all» (13w) - and the question now names it: «Click on screen at 10, 10 - on «Delete» in Finder» (13w, 13x; 13v holds every lookup, not only -the last). The +the last). Clicking the TEXT inside a button (B7) is judged as the button: the helper now gives a point's pressable ancestor +(`control`), so the text in a web chat's Send asks with the recipient and the message (13z1) and the text in «Delete» asks every +time and names it (13z2); an older helper without the field behaves as before. Opera GX, Comet and Dia (Chromium), Orion and +DuckDuckGo (WebKit) and Zen (Gecko) are browsers for both the helper's password-page gate and the send gate - their ids read +from Homebrew's cask data, not measured on an installed copy. A search that stopped early now also names the password manager +pages it skipped (as not-found already did), and a blur answer says how many windows it reached (`windows_scanned`). The send gate now knows every browser the helper knows - Chrome Beta, Dev and for Testing, Edge's three channels, Brave Beta and Nightly, Firefox Nightly - compared without case, so a web chat's Send there is judged like in Chrome (`test/claims-offline.mjs` keeps the two lists in step). A web page whose address cannot be read - in any app, since the address rule applies diff --git a/helper/Sources/cmcp-helper/Accessibility.swift b/helper/Sources/cmcp-helper/Accessibility.swift index 3aaf3006..f802f653 100644 --- a/helper/Sources/cmcp-helper/Accessibility.swift +++ b/helper/Sources/cmcp-helper/Accessibility.swift @@ -83,6 +83,8 @@ enum AX { "com.brave.Browser", "com.brave.Browser.beta", "com.brave.Browser.nightly", "com.microsoft.edgemac", "com.microsoft.edgemac.Beta", "com.microsoft.edgemac.Dev", "com.microsoft.edgemac.Canary", "com.vivaldi.Vivaldi", "company.thebrowser.Browser", "com.operasoftware.Opera", + // Foer npm (Opus R11-O5): id'erne fra Homebrew cask-dataens praeference-/container-stier 6/11 (bevis/browser-ids-2026-11-06). + "com.operasoftware.OperaGX", "ai.perplexity.comet", "company.thebrowser.dia", ] /// ⛔ MAALT 4/11: Chrome bygger web-traeet ASYNKRONT efter kontakten. Det kald der @@ -249,6 +251,26 @@ enum AX { return wins } + /// Foer npm (B7, Opus R11-O4): et klik paa TEKSTEN i en knap rammer et AXStaticText uden navn - knappen selv (fx «Send») + /// var usynlig for sende-dommen. Er punktet tekst, et billede eller en gruppe, gaar vi hoejst 4 led op og giver den foerste + /// trykbare forfader (rolle + navn). Et vindue, et web-omraade eller programmet stopper soegningen. + static func knapForfader(_ el: AXUIElement) -> [String: String]? { + let selv = string(el, kAXRoleAttribute as String) ?? "" + guard ["AXStaticText", "AXImage", "AXGroup", ""].contains(selv) else { return nil } + var cur = el + for _ in 0..<4 { + guard let p = attr(cur, kAXParentAttribute as String), CFGetTypeID(p) == AXUIElementGetTypeID() else { return nil } + let pe = p as! AXUIElement + let r = string(pe, kAXRoleAttribute as String) ?? "" + if ["AXButton", "AXLink", "AXMenuItem", "AXMenuButton", "AXPopUpButton", "AXCheckBox", "AXRadioButton"].contains(r) { + return ["role": r, "title": string(pe, kAXTitleAttribute as String) ?? "", "description": string(pe, kAXDescriptionAttribute as String) ?? ""] + } + if ["AXWindow", "AXWebArea", "AXApplication"].contains(r) { return nil } + cur = pe + } + return nil + } + static func attr(_ el: AXUIElement, _ name: String) -> CFTypeRef? { var value: CFTypeRef? let fejl = AXUIElementCopyAttributeValue(el, name as CFString, &value) @@ -829,7 +851,9 @@ enum AX { return erBrowser(bid) ? "an element in a browser whose page could not be checked" : nil } static let andreBrowsere: Set = ["com.apple.safari", "com.apple.safaritechnologypreview", "org.mozilla.firefox", - "org.mozilla.firefoxdeveloperedition", "org.mozilla.nightly"] + "org.mozilla.firefoxdeveloperedition", "org.mozilla.nightly", + // Foer npm (Opus R11-O5): Orion og DuckDuckGo (WebKit), Zen (Gecko) - samme kilde som ovenfor. + "com.kagi.kagimacos", "com.duckduckgo.macos.browser", "app.zen-browser.zen", "org.mozilla.com.zen.browser"] static func erBrowser(_ bid: String?) -> Bool { erChromium(bid) || andreBrowsere.contains((bid ?? "").lowercased()) } /// Er dette element et web-omraade med en adgangskode-side? Svarer grunden, ellers nil. @@ -868,6 +892,9 @@ enum AX { /// Loeber tiden alligevel ud, sloerer vi HELE det program vi ikke naaede /// - aldrig et billede med et ugennemgaaet vindue paa. static var sloeringStoppede: [String] = [] + /// Foer npm (Astra R14-2): hvor mange vinduer sloeringen faktisk naaede (gennemgaaet eller svaertet med en grund) - saa en + /// maaler kan skelne «0 felter fundet» fra «0 vinduer set». + static var sloeringVinduer = 0 /// Adgangskode-sider som `find` sprang over i dette kald (vault-porten). static var vaultSprunget: [String] = [] @@ -875,6 +902,7 @@ enum AX { maxDepth: Int = 40, indenfor: Rect? = nil) -> [Rect] { var out: [Rect] = [] sloeringStoppede = [] + sloeringVinduer = 0 let start = Date() let deny = defaultDenyBundles.union(extraDeny) let visible = onScreenPIDs() @@ -992,6 +1020,7 @@ enum AX { sloeringStoppede.append(etiket(app, bid) + " (the scan ran out of time)") continue } + sloeringVinduer += 1 // ⛔ MAALT 4/11: Chrome har ogsaa titelloese hjaelpe-vinduer (fanelinje og // vaerktoejslinje som strimler paa 41-47 punkters hoejde, og et paa 13 i // bredden). De har aldrig et web-omraade, og foerste udgave svaertede dem i diff --git a/helper/Sources/cmcp-helper/main.swift b/helper/Sources/cmcp-helper/main.swift index 7af2a014..9f4a9e4f 100644 --- a/helper/Sources/cmcp-helper/main.swift +++ b/helper/Sources/cmcp-helper/main.swift @@ -87,8 +87,14 @@ func vaelgTraef(_ hits: [AX.Match], _ args: Args, maaGaette: Bool) -> AX.Match { let hvorfor = AX.tidSlut ? "the search stopped after \(Int(AX.tidsgraense)) seconds before it had seen the whole app" : "part of this browser's tree could not be read (a role lookup failed, or a page's address could not be read to rule out a password manager), so the search did not see the whole app" - Out.fail("\(hvorfor), so another matching element cannot be ruled out - nothing was done. Narrow the search (role, subrole, title or a lower depth), or pick one with index from computer_find.", - code: "search-incomplete", extra: ["matches": hits.map(\.dict), "count": hits.count, "stopped_early": true]) + // Foer npm (kvittering 1105-162257): var en adgangskode-side ogsaa sprunget over, skal det siges her som ved not-found (A6) - + // ellers leder agenten videre i ring efter noget den aldrig maa naa. + var ekstra: [String: Any] = ["matches": hits.map(\.dict), "count": hits.count, "stopped_early": true] + let sprungne = Array(Set(AX.vaultSprunget)).sorted() + if !sprungne.isEmpty { ekstra["skipped_password_pages"] = sprungne } + let vaultTekst = sprungne.isEmpty ? "" : " \(sprungne.count) password manager page(s) were not searched either; an agent does not act there." + Out.fail("\(hvorfor), so another matching element cannot be ruled out - nothing was done.\(vaultTekst) Narrow the search (role, subrole, title or a lower depth), or pick one with index from computer_find.", + code: "search-incomplete", extra: ekstra) case .udenforListen: Out.fail("there is no match number \(args.int("index") ?? -1); there are \(hits.count)", code: "not-found", extra: ["matches": hits.map(\.dict), "count": hits.count]) @@ -198,7 +204,7 @@ case "secure-rects": Perms.require(accessibility: true) let rects = AX.secureRects(scopeBundleId: args.str("app"), extraDeny: denySet(args)) // R2 5/11: HVORFOR et vindue blev svaertet helt - saa en proeve kan kraeve den rigtige grund, ikke bare et rektangel. - Out.ok(["rects": rects.map(\.dict), "count": rects.count, "whole_window": AX.sloeringStoppede]) + Out.ok(["rects": rects.map(\.dict), "count": rects.count, "whole_window": AX.sloeringStoppede, "windows_scanned": AX.sloeringVinduer]) case "screenshot": // ⛔ 24/9: et ukendt flag paa DENNE kommando skal afvises, ikke ignoreres. @@ -725,7 +731,8 @@ case "at": "window": AX.vinduesTitel(el!) ?? "", "frame": AX.frame(el!)?.dict ?? [:], "window_number": vinduesNr as Any, - "under": under + "under": under, + "control": AX.knapForfader(el!) as Any // foer npm (B7): den trykbare forfader til en tekst i en knap, ellers null ]) case "vault-url": diff --git a/mcp-server/index.js b/mcp-server/index.js index a504e157..1a3894cd 100644 --- a/mcp-server/index.js +++ b/mcp-server/index.js @@ -686,8 +686,15 @@ const klikPunkt = (name, args) => name === 'computer_drag' ? [args.fromX, args.f // Hvordan et element under et klik naevnes for mennesket: titel, ellers beskrivelse, ellers rollen. function knapNavn(e) { - const n = String(e?.title || e?.description || '').trim(); - return n ? `«${n.slice(0, 80)}»` : `an unnamed ${String(e?.role || 'element').replace(/^AX/, '').toLowerCase()}`; + const k = forfader(e); + const n = String(e?.title || e?.description || k?.title || k?.description || '').trim(); + return n ? `«${n.slice(0, 80)}»` : `an unnamed ${String(k?.role || e?.role || 'element').replace(/^AX/, '').toLowerCase()}`; +} +// Foer npm (B7, Opus R11-O4): hjaelperen giver den trykbare forfader til en tekst/et billede i en knap (`control`). En aeldre +// hjaelper giver den ikke - saa er alt som foer. +function forfader(e) { + const c = e?.control; + return c && typeof c === 'object' && typeof c.role === 'string' ? c : null; } async function knapErFarlig(name, args, appKlik = null, forhaand = null) { @@ -699,8 +706,9 @@ async function knapErFarlig(name, args, appKlik = null, forhaand = null) { if (!d?.found) return true; // R4 5/11 (Astra): et punkt i en adgangskode-side inde i en browser er lige saa farligt som et adgangskode-program. if (d.password_page) return true; - const navne = [d.title, d.description].filter(Boolean); - if (!navne.length) return kanVaereKnap(d.role); + const c = forfader(d); + const navne = [d.title, d.description, c?.title, c?.description].filter(Boolean); + if (!navne.length) return kanVaereKnap(c?.role || d.role); return navne.some(n => menuSerFarlig(n)); } catch { return true; } } @@ -727,7 +735,8 @@ async function sendeDom(name, args, bid, appKlik = null, forhaand = null) { } else if (KLIK_LIG(name)) { const [kx, ky] = klikPunkt(name, args); const d = appKlik || forhaand || await callHelper(['at', '--x', String(kx), '--y', String(ky)], { timeout: 8000 }); - kontrolSvar = { navne: [d.title, d.description], rolle: d.role, vindue: d.window || null, ramme: d.frame || null, + const c = forfader(d); + kontrolSvar = { navne: [d.title, d.description, c?.title, c?.description], rolle: c?.role || d.role, vindue: d.window || null, ramme: d.frame || null, fundet: !!d.found, andetProgram: d.bundleId !== bid }; } else kontrolSvar = null; } catch { kontrolSvar = { fejl: true }; } @@ -2300,7 +2309,7 @@ async function haandterKald(request) { // farlig og godkendt, skal den samme knap (navn og rolle) staa der i HVERT genmaalt opslag - ellers klikkes der ikke. if (KLIK_LIG(name) && knapFarlig && knapEl && effektivTier !== TIER.READ && !kunLaes) { const igenPunkter = appKlik ? [nuKlik, igenKlik].filter(Boolean) : (!args.app && nuKoordinat ? [nuKoordinat] : []); - const id = (e) => JSON.stringify([e?.title || '', e?.description || '', e?.role || '']); + const id = (e) => JSON.stringify([e?.title || '', e?.description || '', e?.role || '', forfader(e)?.role || '', forfader(e)?.title || '', forfader(e)?.description || '']); const skiftet = igenPunkter.find(e => id(e) !== id(knapEl)); if (skiftet) return `the button under that point changed after the person approved it (was ${knapNavn(knapEl)}, now ${knapNavn(skiftet)}), so nothing was done`; } diff --git a/mcp-server/policy.js b/mcp-server/policy.js index e8dbb0fa..0bb2bb09 100644 --- a/mcp-server/policy.js +++ b/mcp-server/policy.js @@ -158,7 +158,10 @@ export const BROWSERE = new Set([ 'org.chromium.Chromium', 'company.thebrowser.Browser', 'com.microsoft.edgemac', 'com.microsoft.edgemac.Beta', 'com.microsoft.edgemac.Dev', 'com.microsoft.edgemac.Canary', 'org.mozilla.firefox', 'org.mozilla.firefoxdeveloperedition', 'org.mozilla.nightly', 'com.brave.Browser', 'com.brave.Browser.beta', - 'com.brave.Browser.nightly', 'com.operasoftware.Opera', 'com.vivaldi.Vivaldi' + 'com.brave.Browser.nightly', 'com.operasoftware.Opera', 'com.vivaldi.Vivaldi', + // Foer npm (Opus R11-O5): Opera GX, Comet, Dia, Orion, DuckDuckGo, Zen - id'erne fra Homebrew cask-dataen 6/11. + 'com.operasoftware.OperaGX', 'ai.perplexity.comet', 'company.thebrowser.dia', 'com.kagi.kagimacOS', + 'com.duckduckgo.macos.browser', 'app.zen-browser.zen', 'org.mozilla.com.zen.browser' ]); const BROWSERE_LAV = new Set([...BROWSERE].map((b) => b.toLowerCase())); // ⛔ Runde 2 30/9 (Astra 4, Fable 7): «Signal processing - Wikipedia» og «Teams of the diff --git a/test/bundet-maal.mjs b/test/bundet-maal.mjs index a1f022fa..9b74592b 100644 --- a/test/bundet-maal.mjs +++ b/test/bundet-maal.mjs @@ -684,6 +684,27 @@ for (const [nr, tekst, args, rolle] of [ `traek ${traek.length} · ` + r.tekst.slice(0, 160)); srv.kill(); } +// 13z1-13z2 · foer npm (B7, Opus R11-O4): et klik paa TEKSTEN i en knap (AXStaticText uden navn) doemmes som knappen - +// hjaelperen giver dens trykbare forfader i `control`. 13z1: teksten i en webchats Send -> sende-spoergsmaalet (Mor, «hej»). +// 13z2: teksten i en «Delete»-knap -> spoerges hver gang, og spoergsmaalet naevner «Delete». +{ + const CHAT = { window: 'WhatsApp', headings: ['Mor'], column: true, field: { role: 'AXTextArea', value: 'hej', frame: { x: 0, y: 40, w: 280, h: 40 } } }; + const SENDTEKST = { found: true, app: 'Google Chrome', bundleId: 'com.google.Chrome', pid: 400, role: 'AXStaticText', title: '', description: '', window: 'WhatsApp', frame: { x: 292, y: 50, w: 30, h: 16 }, under: ['com.google.Chrome'], control: { role: 'AXButton', title: 'Send', description: '' } }; + const DELTEKST = { found: true, app: 'Finder', bundleId: 'com.apple.finder', pid: 300, role: 'AXStaticText', title: '', description: '', window: 'Dokumenter', frame: { x: 0, y: 0, w: 40, h: 16 }, under: ['com.apple.finder'], control: { role: 'AXButton', title: 'Delete', description: '' } }; + const APPSC = { apps: [{ name: 'Google Chrome', bundleId: 'com.google.Chrome', pid: 400, active: false }, { name: 'Finder', bundleId: 'com.apple.finder', pid: 300, active: true }] }; + for (const [id, hvad, el, samtale, forvent] of [ + ['13z1', 'klik paa teksten i en webchats Send-knap: sende-spoergsmaalet med modtager og tekst', SENDTEKST, CHAT, (t) => /Mor/.test(t) && /hej/.test(t)], + ['13z2', 'klik paa teksten i en «Delete»-knap: spoerges, og spoergsmaalet naevner «Delete»', DELTEKST, { window: 'Dokumenter' }, (t) => /«Delete»/.test(t)], + ]) { + const sp = lavFalskSpoerger('ja', 'cmcp-bundet-b7'); + const { srv, rpc, kald, hj } = klient({ apps: APPSC, at: el, samtale, idle: { idle: 600 } }, { CMCP_BACKGROUND: '0', CMCP_OSASCRIPT: sp.sti }); + await rpc('initialize', { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'bundet', version: '1' } }); + const r = await kald('computer_click', { x: 300, y: 55 }); + const spm = sp.tekster(); + check(`${id} ${hvad}`, spm.length >= 1 && spm.some(forvent), `spurgt ${sp.gangeSpurgt()} · ` + spm.map(t => t.replace(/\s+/g, ' ').slice(0, 200)).join(' | ') + ' · ' + r.tekst.slice(0, 100)); + srv.kill(); + } +} // 12m · R11 (Astra, mutant S): et klik uden app doemmes paa ÉT opslag - sende-dommen og knapErFarlig genbruger ejerens. // Et almindeligt klik i en browser giver derfor praecis to `at`: dommen og genmaalingen under laasen. { diff --git a/test/claims-offline.mjs b/test/claims-offline.mjs index 900f87a4..f960f34e 100644 --- a/test/claims-offline.mjs +++ b/test/claims-offline.mjs @@ -248,7 +248,20 @@ check('kontakten kan slaas fra, saa tallet kan efterproeves udefra', const mangler = ids.filter((b) => beskedSlags(b) !== 'browser'); check(`sende-dommen kender alle ${ids.length} browsere hjaelperen kender (og Chromes kanaler efter segmentreglen)`, ids.length >= 18 && mangler.length === 0 && beskedSlags('com.google.chrome.for.testing') === 'browser', `mangler: ${mangler.join(', ')}`); + // Foer npm (Opus R11-O5): de seks browsere uden for begge lister - i BEGGE nu (hjaelperens vault-port og serverens sende-dom). + const nye = ['com.operasoftware.OperaGX', 'ai.perplexity.comet', 'company.thebrowser.dia', 'com.kagi.kagimacOS', 'com.duckduckgo.macos.browser', 'app.zen-browser.zen']; + const lav = ids.map((x) => x.toLowerCase()); + const udenfor = nye.filter((b) => beskedSlags(b) !== 'browser' || !lav.includes(b.toLowerCase())); + check('Opera GX, Comet, Dia, Orion, DuckDuckGo og Zen er browsere for baade hjaelperen og sende-dommen', udenfor.length === 0, `mangler: ${udenfor.join(', ')}`); } + // Foer npm: hjaelperens nye felter - en ufuldstaendig soegning naevner sprungne adgangskode-sider; sloeringen siger hvor mange + // vinduer den naaede; et punkt-opslag giver en teksts trykbare forfader (B7). + check('hjaelperen: search-incomplete baerer skipped_password_pages, naar en adgangskode-side blev sprunget over', + /if !sprungne\.isEmpty \{ ekstra\["skipped_password_pages"\] = sprungne \}/.test(mainSw) && /code: "search-incomplete", extra: ekstra\)/.test(mainSw), 'reglen mangler'); + check('hjaelperen: secure-rects svarer windows_scanned (taelt efter tidsgraensen, nulstillet ved start)', + /"windows_scanned": AX\.sloeringVinduer/.test(mainSw) && /sloeringVinduer = 0/.test(sw) && /\n\s+sloeringVinduer \+= 1/.test(sw), 'feltet eller taellingen mangler'); + check('hjaelperen: at giver den trykbare forfader (control) til en tekst i en knap', + /"control": AX\.knapForfader\(el!\)/.test(mainSw) && /static func knapForfader/.test(sw), 'control mangler'); check('vault-porten: wait-for og et tomt soegeresultat siger, at adgangskode-sider ikke blev gennemsoegt', /password manager page\(s\) were not searched; their content is never returned/.test(mainSw) && /password manager page\(s\) were not searched; like password manager apps/.test(mainSw), 'wait-for eller not-found tier om sprungne sider'); From 36b4f5492c4126ab7f0221a37ac9d750f36ff126 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Fri, 6 Nov 2026 11:50:00 +0100 Subject: [PATCH 73/94] Foer npm: README og npm-README - Opera GX, Comet og Dia (id'er fra Homebrew, ikke maalt), teksten i en knap doemmes som knappen, farlig knap navngives og maa ikke skifte Co-Authored-By: Claude Opus 5.5 --- README.md | 12 +++++++++--- mcp-server/README.md | 12 +++++++++--- 2 files changed, 18 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 0639dbb2..758635a9 100644 --- a/README.md +++ b/README.md @@ -39,7 +39,9 @@ in the hours you are not watching. switch - asked for it, it answers that the attribute does not exist - and has its own: the one a screen reader sets. This server sets that one in Google Chrome (every channel, Chrome for Testing included) and in Edge, - Brave, Arc, Vivaldi, Opera and Chromium. Measured 5 Nov on Chrome 156: a + Brave, Arc, Vivaldi, Opera, Opera GX, Comet, Dia and Chromium (only Google + Chrome is measured; the ids of Opera GX, Comet and Dia are read from Homebrew's + cask data, not from an installed copy). Measured 5 Nov on Chrome 156: a test page went from **0 page elements to 6**, its password field among them and blacked out; the redaction scan of a heavy everyday Chrome took 0.14 to 0.54 s. `test/chrome-side-live.mjs` proves it against a real Chrome. @@ -443,14 +445,18 @@ all this product puts on your screen, and neither ever takes focus. (WhatsApp, Messenger, Slack, Teams, Telegram, Discord, LinkedIn, Instagram, Facebook, Google Chat, X, Gmail, Outlook and a few more - a chat on any other site is not recognised), pressing or - clicking Send - in several languages, or a button with no name at all - and + clicking Send - in several languages, or a button with no name at all, or the + text inside such a button - and pressing Return in a chat (Cmd+Return in mail) asks you first, for that one message. The question shows who it goes to and what it says, read from the screen by the server: the name above the text field, and the field itself. If either cannot be read, nothing is sent - you send it yourself. A line break typed into a chat is refused, because there it sends; in mail it is just a new line. If the conversation or the text changes after you say yes, nothing is - sent. What it cannot see: apps not on the list, and messages sent by other + sent. A button that looks like it deletes, sends or pays asks every time and + the question names it («Click on screen at 10, 10 - on «Delete» in Finder»); + if it is a different button when the click is about to happen, nothing is + clicked. What it cannot see: apps not on the list, and messages sent by other tools your client allows, such as browser automation or `osascript`. - **It tells you where it can be walked around.** The gate guards this server's own calls, not your whole Mac. `computer_permissions` lists the rules it diff --git a/mcp-server/README.md b/mcp-server/README.md index a45aad28..497cb9da 100644 --- a/mcp-server/README.md +++ b/mcp-server/README.md @@ -37,7 +37,9 @@ in the hours you are not watching. switch - asked for it, it answers that the attribute does not exist - and has its own: the one a screen reader sets. This server sets that one in Google Chrome (every channel, Chrome for Testing included) and in Edge, - Brave, Arc, Vivaldi, Opera and Chromium. Measured 5 Nov on Chrome 156: a + Brave, Arc, Vivaldi, Opera, Opera GX, Comet, Dia and Chromium (only Google + Chrome is measured; the ids of Opera GX, Comet and Dia are read from Homebrew's + cask data, not from an installed copy). Measured 5 Nov on Chrome 156: a test page went from **0 page elements to 6**, its password field among them and blacked out; the redaction scan of a heavy everyday Chrome took 0.14 to 0.54 s. `test/chrome-side-live.mjs` proves it against a real Chrome. @@ -441,14 +443,18 @@ all this product puts on your screen, and neither ever takes focus. (WhatsApp, Messenger, Slack, Teams, Telegram, Discord, LinkedIn, Instagram, Facebook, Google Chat, X, Gmail, Outlook and a few more - a chat on any other site is not recognised), pressing or - clicking Send - in several languages, or a button with no name at all - and + clicking Send - in several languages, or a button with no name at all, or the + text inside such a button - and pressing Return in a chat (Cmd+Return in mail) asks you first, for that one message. The question shows who it goes to and what it says, read from the screen by the server: the name above the text field, and the field itself. If either cannot be read, nothing is sent - you send it yourself. A line break typed into a chat is refused, because there it sends; in mail it is just a new line. If the conversation or the text changes after you say yes, nothing is - sent. What it cannot see: apps not on the list, and messages sent by other + sent. A button that looks like it deletes, sends or pays asks every time and + the question names it («Click on screen at 10, 10 - on «Delete» in Finder»); + if it is a different button when the click is about to happen, nothing is + clicked. What it cannot see: apps not on the list, and messages sent by other tools your client allows, such as browser automation or `osascript`. - **It tells you where it can be walked around.** The gate guards this server's own calls, not your whole Mac. `computer_permissions` lists the rules it From 3f33f8751bb8526d7e0a056b2adb50e376f3011e Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Fri, 6 Nov 2026 14:12:24 +0100 Subject: [PATCH 74/94] =?UTF-8?q?Foer=20npm=20(Opus=20R17):=20README=20og?= =?UTF-8?q?=20afvisningsteksten=20lovede=20=C2=ABdeletes,=20sends=20or=20p?= =?UTF-8?q?ays=C2=BB=20-=20reglen=20kender=20slet/ryd/fjern/nulstil/afslut?= =?UTF-8?q?/log=20ud/afinstaller,=20ingen=20betaling.=20Teksten=20siger=20?= =?UTF-8?q?nu=20det,=20koden=20goer?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 5.5 --- README.md | 4 ++-- mcp-server/README.md | 4 ++-- mcp-server/index.js | 2 +- test/bundet-maal.mjs | 6 +++--- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/README.md b/README.md index 758635a9..d6b0b18a 100644 --- a/README.md +++ b/README.md @@ -453,8 +453,8 @@ all this product puts on your screen, and neither ever takes focus. If either cannot be read, nothing is sent - you send it yourself. A line break typed into a chat is refused, because there it sends; in mail it is just a new line. If the conversation or the text changes after you say yes, nothing is - sent. A button that looks like it deletes, sends or pays asks every time and - the question names it («Click on screen at 10, 10 - on «Delete» in Finder»); + sent. A button whose name looks like it deletes, clears, removes, resets, + quits, signs out or uninstalls asks every time, and the question names it («Click on screen at 10, 10 - on «Delete» in Finder»); if it is a different button when the click is about to happen, nothing is clicked. What it cannot see: apps not on the list, and messages sent by other tools your client allows, such as browser automation or `osascript`. diff --git a/mcp-server/README.md b/mcp-server/README.md index 497cb9da..75620be7 100644 --- a/mcp-server/README.md +++ b/mcp-server/README.md @@ -451,8 +451,8 @@ all this product puts on your screen, and neither ever takes focus. If either cannot be read, nothing is sent - you send it yourself. A line break typed into a chat is refused, because there it sends; in mail it is just a new line. If the conversation or the text changes after you say yes, nothing is - sent. A button that looks like it deletes, sends or pays asks every time and - the question names it («Click on screen at 10, 10 - on «Delete» in Finder»); + sent. A button whose name looks like it deletes, clears, removes, resets, + quits, signs out or uninstalls asks every time, and the question names it («Click on screen at 10, 10 - on «Delete» in Finder»); if it is a different button when the click is about to happen, nothing is clicked. What it cannot see: apps not on the list, and messages sent by other tools your client allows, such as browser automation or `osascript`. diff --git a/mcp-server/index.js b/mcp-server/index.js index 1a3894cd..c806e6bb 100644 --- a/mcp-server/index.js +++ b/mcp-server/index.js @@ -2318,7 +2318,7 @@ async function haandterKald(request) { let blevFarlig = false; for (const igenPunkt of igenPunkter) if (await knapErFarlig(name, args, igenPunkt)) { blevFarlig = true; break; } if (blevFarlig) { - return 'what is under that point changed while the agent waited into something that can delete, send or pay, or whose name can no longer be read - that is not what was approved, so nothing was done'; + return 'what is under that point changed while the agent waited into something that looks like it deletes, clears, quits or signs out (or a button whose name can no longer be read) - that is not what was approved, so nothing was done'; } } // ⛔ B5 (29/9, panelet): med laant skaerm TAGER agenten ikke skaermen fra et diff --git a/test/bundet-maal.mjs b/test/bundet-maal.mjs index 9b74592b..bb98639e 100644 --- a/test/bundet-maal.mjs +++ b/test/bundet-maal.mjs @@ -579,7 +579,7 @@ for (const [nr, tekst, args, rolle] of [ await rpc('initialize', { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'bundet', version: '1' } }); const r = await kald(vaerktoej, vaerktoej === 'computer_drag' ? { fromX: 10, fromY: 10, toX: 300, toY: 300 } : { x: 10, y: 10 }); const handling = hj.kald().filter(k => k.argv[0] === (vaerktoej === 'computer_drag' ? 'drag' : 'click')); - const ok = skal ? handling.length === 1 : (handling.length === 0 && r.fejl && /changed while the agent waited into something that can delete/.test(r.tekst)); + const ok = skal ? handling.length === 1 : (handling.length === 0 && r.fejl && /changed while the agent waited into something that looks like it deletes/.test(r.tekst)); check(`${id} ${hvad}`, ok, `handling ${handling.length} · spurgt ${sp.gangeSpurgt()} · ` + r.tekst.slice(0, 160)); srv.kill(); } @@ -591,7 +591,7 @@ for (const [nr, tekst, args, rolle] of [ const klik = hj.kald().filter(k => k.argv[0] === 'click'); const atApp = hj.kald().filter(k => k.argv[0] === 'at' && k.argv.includes('--app')); check('13n klik med app (Notes): OK ved dommen, Delete under laasen - intet klik, og kun de to «at --app»', - klik.length === 0 && r.fejl && /changed while the agent waited into something that can delete/.test(r.tekst) && atApp.length === 2, `klik ${klik.length} · at --app ${atApp.length} · ` + r.tekst.slice(0, 160)); + klik.length === 0 && r.fejl && /changed while the agent waited into something that looks like it deletes/.test(r.tekst) && atApp.length === 2, `klik ${klik.length} · at --app ${atApp.length} · ` + r.tekst.slice(0, 160)); srv.kill(); } // 13q · R14 (Astra R13-3, MAALT): med app i en BROWSER slaas punktet op to gange under laasen (adgangskode- og sende-genkontrol). @@ -610,7 +610,7 @@ for (const [nr, tekst, args, rolle] of [ const r = await kald('computer_click', { app: 'Google Chrome', x: 10, y: 20 }); const klik = hj.kald().filter(k => k.argv[0] === 'click'); const atApp = hj.kald().filter(k => k.argv[0] === 'at' && k.argv.includes('--app')); - const ok = skal ? (klik.length === 1 && atApp.length === 3) : (klik.length === 0 && r.fejl && /changed while the agent waited into something that can delete/.test(r.tekst) && atApp.length === 3); + const ok = skal ? (klik.length === 1 && atApp.length === 3) : (klik.length === 0 && r.fejl && /changed while the agent waited into something that looks like it deletes/.test(r.tekst) && atApp.length === 3); check(`${id} ${hvad}`, ok, `klik ${klik.length} · at --app ${atApp.length} · ` + r.tekst.slice(0, 160)); srv.kill(); } From 227d4101ffd1ef3530ff2542222e3fccd7a1899f Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Fri, 6 Nov 2026 14:54:40 +0100 Subject: [PATCH 75/94] =?UTF-8?q?test:=2015b/15c=20venter=20paa=20attrappe?= =?UTF-8?q?ns=20=C2=ABklar=C2=BB=20(SIGTERM-handleren=20sat),=20ikke=20blo?= =?UTF-8?q?t=20paa=20processen=20-=20kapl=C3=B8b,=20ikke=20produktfejl?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Maalt 6/11: 15c roed 3 af 7 under belastning; de roede lukkede paa ~50 ms uden release-mouse, de groenne paa 650-730 ms med. Attrappen satte sin SIGTERM-handler EFTER at have laest svarfilen - et SIGTERM i hullet draebte den, og serveren sendte (rigtigt) ingen release-mouse, fordi en rigtig hjaelper slipper selv ved SIGTERM. Kalibreret: FALSK_TERM_FORSINK=500 aabner hullet - den gamle proeve roed paa 15c+15b, den nye groen (ogsaa uden knappen). Co-Authored-By: Claude Opus 5.5 --- test/falsk-hjaelper.mjs | 9 +++++++++ test/skaerm-laan.mjs | 8 ++++++-- 2 files changed, 15 insertions(+), 2 deletions(-) diff --git a/test/falsk-hjaelper.mjs b/test/falsk-hjaelper.mjs index e338885d..0cdcc8c1 100644 --- a/test/falsk-hjaelper.mjs +++ b/test/falsk-hjaelper.mjs @@ -93,7 +93,12 @@ try { process.exit(1); }); // R3: «_ignorerTerm» - som den rigtige hjaelper, der blokerer SIGTERM midt i et trin (B19). Kun SIGKILL stopper den. + // 6/11 (kapløb i 15b/15c, MAALT: 3 af 7 roede under belastning): proeven saa processen med pgrep, FOER denne linje var + // naaet - et SIGTERM i hullet draebte attrappen, saa serveren (rigtigt) ikke sendte release-mouse. Nu skriver attrappen + // «klar», naar handleren ER sat, og proeven venter paa det. FALSK_TERM_FORSINK (ms) aabner hullet med vilje (kalibrering). + if (process.env.FALSK_TERM_FORSINK && SVAR[noegle]._ignorerTerm) await new Promise(r => setTimeout(r, Number(process.env.FALSK_TERM_FORSINK))); if (SVAR[noegle]._ignorerTerm) process.on('SIGTERM', () => {}); + appendFileSync(${JSON.stringify(join(dir, 'klar.jsonl'))}, JSON.stringify({ argv, ts: Date.now() }) + '\\n'); await new Promise(r => setTimeout(r, SVAR[noegle]._vent)); } // «_raekke» (R29, Astra): et svar pr. kald i raekkefoelge (det sidste gentages) - saa en @@ -205,6 +210,10 @@ process.exit(r.status === null ? 1 : r.status); /// Tredje gang samme dag at en liste nogen skal huske at udvide, ER /// hullet. Vendt om: alt er en handling, undtagen de opslag vi ved er /// harmloese. Et nyt vaerktoej er daekket den dag det skrives. + /// Hvor mange gange attrappen har sagt «klar» for en kommando (signal-handleren er sat, arbejdet er begyndt). + klar(kommando) { + try { return readFileSync(join(dir, 'klar.jsonl'), 'utf8').split('\n').filter(Boolean).map(l => JSON.parse(l)).filter(k => k.argv[0] === kommando).length; } catch { return 0; } + }, handlingerNaaedeFrem() { const OPSLAG = new Set(HJAELPER_OPSLAG); return this.kald().filter(k => !OPSLAG.has(k.argv[0]) && !k.argv.includes('--dry')); diff --git a/test/skaerm-laan.mjs b/test/skaerm-laan.mjs index a71f31a3..886c57ea 100644 --- a/test/skaerm-laan.mjs +++ b/test/skaerm-laan.mjs @@ -528,9 +528,11 @@ for (const [navn, ekstra, uden] of [['uden kontakten', {}, false], ['tastefejl saet({ idle: { idle: 30 } }); const l = await kl.callTool({ name: 'computer_request_screen', arguments: { action: 'request', reason: 'drag a file', minutes: 3 } }); saet({ idle: { idle: 30 }, drag: { _vent: 9000, _ignorerTerm: true, dragged: true } }); + const klar0 = HJ.klar('drag'); kl.callTool({ name: 'computer_drag', arguments: { fromX: 10, fromY: 10, toX: 50, toY: 50 } }).catch(() => null); const lever = () => { try { return execFileSync('/usr/bin/pgrep', ['-f', `${dirname(HJ.sti)}/[^ ]+ drag`]).toString().trim().split('\n').filter(Boolean).length; } catch { return 0; } }; - let foer = 0; for (let i = 0; i < 30 && !foer; i++) { await vent(100); foer = lever(); } + // 6/11: vent til attrappen HAR sat sin SIGTERM-handler (klar), ikke blot til processen findes - ellers kapløb (15b/15c). + let foer = 0; for (let i = 0; i < 50 && !(foer && HJ.klar('drag') >= klar0 + 1); i++) { await vent(100); foer = lever(); } const slip0 = HJ.handlingerNaaedeFrem().filter(k => k.argv[0] === 'release-mouse').length; const pid = tr.pid; const t0 = Date.now(); @@ -758,9 +760,11 @@ for (const [navn, linjer, stop] of [['16h forkert nonce paa «taken-back», saa saet({ idle: { idle: 30 } }); const l = await X.kald('computer_request_screen', { action: 'request', reason: 'drag a file', minutes: 3 }); saet({ idle: { idle: 30 }, drag: { _vent: 9000, _ignorerTerm: true, dragged: true } }); + const klar0 = HJ.klar('drag'); const kald = X.kald('computer_drag', { fromX: 10, fromY: 10, toX: 50, toY: 50 }).catch(() => null); const lever = () => { try { return execFileSync('/usr/bin/pgrep', ['-f', `${dirname(HJ.sti)}/[^ ]+ drag`]).toString().trim().split('\n').filter(Boolean).length; } catch { return 0; } }; - let foer = 0; for (let i = 0; i < 30 && !foer; i++) { await vent(100); foer = lever(); } + // 6/11: vent til attrappen HAR sat sin SIGTERM-handler (klar), ikke blot til processen findes - ellers kapløb (15b/15c). + let foer = 0; for (let i = 0; i < 50 && !(foer && HJ.klar('drag') >= klar0 + 1); i++) { await vent(100); foer = lever(); } const slip0 = HJ.handlingerNaaedeFrem().filter(k => k.argv[0] === 'release-mouse').length; const t0 = Date.now(); X.srv.kill('SIGTERM'); From 18a28e88da978ccb8dd62c2f3f57e0e5b8ffe271 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Fri, 6 Nov 2026 15:02:37 +0100 Subject: [PATCH 76/94] =?UTF-8?q?CHANGELOG:=20=C3=A9n=200.4.1-sektion=20(#?= =?UTF-8?q?11=20+=20#10=20+=20Chrome-sporet);=20Chrome-noterne=20stod=20un?= =?UTF-8?q?der=200.4.0,=20men=20er=20nye=20i=20forhold=20til=20main=20-=20?= =?UTF-8?q?intet=20indhold=20tabt=20(linje-sammenligning)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 53981188..ae29f00c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -63,8 +63,6 @@ foreground they ask every time. The 0.4.0 notes say "A click behind never leaves a menu over your work." In the mutation gate on GitHub's Mac a menu opened by a click behind was left open, and the reply said so (`menu_closed: false`). -## 0.4.1 (in progress) - **The web goes through the Chrome you already use.** The instructions the server sends with it now say that a step on the web uses the Chrome the person normally uses and is signed in to - not Safari, a new profile or another browser - and that the agent asks the person when it cannot tell which profile a task belongs to. This server does @@ -73,8 +71,6 @@ profile where their extension is installed; when they are not and the task is mo once that Browser MCP does that, with its install line, and never installs it itself. Test: `test/laering.mjs` 1c-1h. -## 0.4.0 (in progress) - **Chrome pages are visible, and their password fields are blacked out.** The switch we set to make apps build their accessibility tree is Electron's; Chrome does not have it (asked for it by name, macOS answers -1728). Chrome's own is the one a screen @@ -212,6 +208,8 @@ in the loan's last second is still a stop. A typo keeps the question. The audit you were asked. (`test/skaerm-laan.mjs` 14-16, `test/ikon-menu.mjs` 3f-3h, `test/ikon-boks.mjs` 5z) +## 0.4.0 (in progress) + **A stop lets go of the mouse button and starts nothing new.** A drag holds the button down for up to a few seconds, and a click or a key is down for a moment. If the screen loan ended or you pressed `Stop all agents now` in that moment, the @@ -734,7 +732,6 @@ app's own queue does not. writing. `computer_launch` takes `background: true` and starts the app behind what you are doing. `CMCP_BACKGROUND=0` adds the nine that cannot be made quiet. - **The menu bar.** A large part of macOS has no button on screen at all: File > Export, Edit > Find, Format > Font. Without menus an agent can see those actions and not reach them, which was the biggest single gap between what a person can From 31cca99424f468260aa8fa46397b50ca0c092910 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Fri, 6 Nov 2026 15:10:53 +0100 Subject: [PATCH 77/94] =?UTF-8?q?Fletning:=20#10's=20=C2=ABThis=20server?= =?UTF-8?q?=20does=20not=20see=20inside=20pages=C2=BB=20modsagde=20Chrome-?= =?UTF-8?q?sporet=20i=20samme=20instruktioner=20-=20nu:=20serveren=20laese?= =?UTF-8?q?r=20Chrome-sider=20gennem=20tilgaengelighedslaget,=20Browser=20?= =?UTF-8?q?MCP=20arbejder=20bedre=20inde=20i=20siden?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit laering (#10's proeve) og claims-offline groenne. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 3 ++- mcp-server/index.js | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ae29f00c..81a360fa 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -66,7 +66,8 @@ click behind was left open, and the reply said so (`menu_closed: false`). **The web goes through the Chrome you already use.** The instructions the server sends with it now say that a step on the web uses the Chrome the person normally uses and is signed in to - not Safari, a new profile or another browser - and that the agent asks the person when it cannot tell which profile a task belongs to. This server does -not see inside pages, so when Browser MCP's tools are in the session, the work inside the page is theirs, in the +not do the work inside pages as well as Browser MCP does (this server reads Chrome pages through the accessibility +layer; Browser MCP acts in the page itself), so when Browser MCP's tools are in the session, the work inside the page is theirs, in the profile where their extension is installed; when they are not and the task is mostly in web pages, the agent says once that Browser MCP does that, with its install line, and never installs it itself. Test: `test/laering.mjs` 1c-1h. diff --git a/mcp-server/index.js b/mcp-server/index.js index 1bfe0253..029e0af2 100644 --- a/mcp-server/index.js +++ b/mcp-server/index.js @@ -292,7 +292,8 @@ new profile or another browser, unless they ask for one. \`computer_windows\` with app "Google Chrome" shows its windows. If you cannot tell which profile the task belongs to - windows from several are open, or the titles do not say - ask the person once with \`computer_ask_user\` - never pick one yourself. This server -does not see inside pages, so if Browser MCP's tools (browser_*) are in this session, let them do +reads Chrome pages through the accessibility layer, but Browser MCP works inside a page far better (the page itself, +with the person's sign-ins), so if Browser MCP's tools (browser_*) are in this session, let them do the work inside the page - they work in the Chrome profile where their extension is installed, which browser_about names, so check it is that same profile - and keep this server for what is outside it: the file picker, an OS dialog, another From 60d2bb9a22d72e8514c541457517e177b05c36ae Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Fri, 6 Nov 2026 16:24:17 +0100 Subject: [PATCH 78/94] Send verdict: an ancestor's name can only add danger, and names show on one line MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Opus R18 (O1, O3): the button's own name decided first; an ancestor without a dangerous name could turn a nameless AXImage inside AXButton «Open» into «not a sender». Now the element and its ancestor are each judged on their own, and either can make it dangerous (monotone). The name in the question is collapsed to one line. Tests 13z3/13z4, each red under its mutant. Co-Authored-By: Claude Opus 5.5 --- mcp-server/index.js | 20 ++++++++++++-------- test/bundet-maal.mjs | 18 ++++++++++++++++++ 2 files changed, 30 insertions(+), 8 deletions(-) diff --git a/mcp-server/index.js b/mcp-server/index.js index 029e0af2..e6e9c06a 100644 --- a/mcp-server/index.js +++ b/mcp-server/index.js @@ -703,7 +703,8 @@ const klikPunkt = (name, args) => name === 'computer_drag' ? [args.fromX, args.f // Hvordan et element under et klik naevnes for mennesket: titel, ellers beskrivelse, ellers rollen. function knapNavn(e) { const k = forfader(e); - const n = String(e?.title || e?.description || k?.title || k?.description || '').trim(); + // Opus R17 O3 (MAALT): sidens tekst gik raa ind i dialogen («Delete\n\nThis is a harmless …»). Nu én linje. + const n = String(e?.title || e?.description || k?.title || k?.description || '').replace(/\s+/g, ' ').trim(); return n ? `«${n.slice(0, 80)}»` : `an unnamed ${String(k?.role || e?.role || 'element').replace(/^AX/, '').toLowerCase()}`; } // Foer npm (B7, Opus R11-O4): hjaelperen giver den trykbare forfader til en tekst/et billede i en knap (`control`). En aeldre @@ -722,10 +723,11 @@ async function knapErFarlig(name, args, appKlik = null, forhaand = null) { if (!d?.found) return true; // R4 5/11 (Astra): et punkt i en adgangskode-side inde i en browser er lige saa farligt som et adgangskode-program. if (d.password_page) return true; + // Opus R17 O1 (MAALT): forfaderen ERSTATTEDE elementets uvished - et navnloest ikon i en knap «Open» blev ufarligt og klikket + // uden spoergsmaal. Nu er dommen MONOTON: elementets egen dom gaelder, og forfaderen kan kun laegge fare oveni. + const egen = (navne, rolle) => { const n = navne.filter(Boolean); return n.length ? n.some(x => menuSerFarlig(x)) : kanVaereKnap(rolle); }; const c = forfader(d); - const navne = [d.title, d.description, c?.title, c?.description].filter(Boolean); - if (!navne.length) return kanVaereKnap(c?.role || d.role); - return navne.some(n => menuSerFarlig(n)); + return egen([d.title, d.description], d.role) || (c ? egen([c.title, c.description], c.role) : false); } catch { return true; } } return false; @@ -752,8 +754,9 @@ async function sendeDom(name, args, bid, appKlik = null, forhaand = null) { const [kx, ky] = klikPunkt(name, args); const d = appKlik || forhaand || await callHelper(['at', '--x', String(kx), '--y', String(ky)], { timeout: 8000 }); const c = forfader(d); - kontrolSvar = { navne: [d.title, d.description, c?.title, c?.description], rolle: c?.role || d.role, vindue: d.window || null, ramme: d.frame || null, - fundet: !!d.found, andetProgram: d.bundleId !== bid }; + // Opus R17 O1: elementets egne navne og rolle doemmes for sig; forfaderen (B7) doemmes oveni, aldrig i stedet. + kontrolSvar = { navne: [d.title, d.description], rolle: d.role, forfader: c ? { navne: [c.title, c.description], rolle: c.role } : null, + vindue: d.window || null, ramme: d.frame || null, fundet: !!d.found, andetProgram: d.bundleId !== bid }; } else kontrolSvar = null; } catch { kontrolSvar = { fejl: true }; } return kontrolSvar; @@ -812,10 +815,11 @@ async function sendeDom(name, args, bid, appKlik = null, forhaand = null) { if (!k || k.fejl) sender = true; else { // Intet element, et andet program foran, eller et element UDEN navn: vi ved ikke hvad det er - saa er det en mulig send. - sender = (KLIK_LIG(name) && (!k.fundet || k.andetProgram)) || navnSender(k.navne, k.rolle, KLIK_LIG(name)); + sender = (KLIK_LIG(name) && (!k.fundet || k.andetProgram)) || navnSender(k.navne, k.rolle, KLIK_LIG(name)) + || (k.forfader ? navnSender(k.forfader.navne, k.forfader.rolle, KLIK_LIG(name)) : false); knapVindue = k.vindue; knapRamme = k.ramme; // Foer npm (Opus R12 X5): et NAVNLOEST element (fx et billede man traekker ud af en chat) kaldtes «the Send control». - navnloes = !k.fundet || k.andetProgram || !k.navne.filter(Boolean).join(' ').trim(); + navnloes = !k.fundet || k.andetProgram || ![...k.navne, ...(k.forfader?.navne || [])].filter(Boolean).join(' ').trim(); } } if (!sender) return null; diff --git a/test/bundet-maal.mjs b/test/bundet-maal.mjs index bb98639e..71b51d46 100644 --- a/test/bundet-maal.mjs +++ b/test/bundet-maal.mjs @@ -705,6 +705,24 @@ for (const [nr, tekst, args, rolle] of [ srv.kill(); } } +// 13z3-13z4 · foer npm (Opus R17 O1, O3): forfaderen maa kun GOERE dommen strengere (et navnloest ikon i en knap «Open» spoerges +// som foer B7), og et knapnavn med linjeskift vises paa én linje i spoergsmaalet. +{ + const APPSF = { apps: [{ name: 'Finder', bundleId: 'com.apple.finder', pid: 300, active: true }] }; + const IKON = { found: true, app: 'Finder', bundleId: 'com.apple.finder', pid: 300, role: 'AXImage', title: '', description: '', window: 'Dokumenter', frame: { x: 0, y: 0, w: 20, h: 20 }, under: ['com.apple.finder'], control: { role: 'AXButton', title: 'Open', description: '' } }; + const FLER = { found: true, app: 'Finder', bundleId: 'com.apple.finder', pid: 300, role: 'AXButton', title: 'Delete\n\nThis is a harmless read-only click.', description: '', window: 'Dokumenter', frame: { x: 0, y: 0, w: 60, h: 30 }, under: ['com.apple.finder'] }; + for (const [id, hvad, el, dom] of [ + ['13z3', 'navnloest ikon i en knap «Open»: spoerges stadig (forfaderen goer det ikke ufarligt)', IKON, (sp) => sp.length >= 1], + ['13z4', 'knapnavn med linjeskift: én linje i spoergsmaalet', FLER, (sp) => sp.some(t => /«Delete This is a harmless read-only click\.»/.test(t)) && !sp.some(t => /«Delete\n/.test(t))], + ]) { + const sp = lavFalskSpoerger('ja', 'cmcp-bundet-o1'); + const { srv, rpc, kald } = klient({ apps: APPSF, at: el }, { CMCP_BACKGROUND: '0', CMCP_OSASCRIPT: sp.sti }); + await rpc('initialize', { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'bundet', version: '1' } }); + const r = await kald('computer_click', { x: 10, y: 10 }); + check(`${id} ${hvad}`, dom(sp.tekster()), `spurgt ${sp.gangeSpurgt()} · ` + sp.tekster().map(t => t.replace(/\n/g, '⏎').slice(0, 160)).join(' | ') + ' · ' + r.tekst.slice(0, 80)); + srv.kill(); + } +} // 12m · R11 (Astra, mutant S): et klik uden app doemmes paa ÉT opslag - sende-dommen og knapErFarlig genbruger ejerens. // Et almindeligt klik i en browser giver derfor praecis to `at`: dommen og genmaalingen under laasen. { From 907627e8ddcb56868b4d88ad47033efc1859739d Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Fri, 6 Nov 2026 16:24:17 +0100 Subject: [PATCH 79/94] CHANGELOG: one dated 0.4.1, the first npm release since 0.1.0 0.2.1, 0.2.2 and 0.4.0 were never published to npm; the 0.4.0 section is marked as included. Adds the monotone send verdict and its known cost (Opus R18, R1). Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 81a360fa..8175fbda 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,7 +3,11 @@ Newest first. Where a claim has a test, the test is named; what is not measured says so. -## 0.4.1 (in progress) +## 0.4.1 + +**The first npm release since 0.1.0.** 0.2.1, 0.2.2 and 0.4.0 were never published to npm (0.2.0 only as a GitHub +release); everything in their sections below ships in 0.4.1. The notes in this section are what changed since the 0.4.0 +section was written. **The consent box no longer says password apps ask while the agent works in the background.** In the background they are refused outright, but the box said @@ -149,7 +153,11 @@ button (name and role) at every lookup under the lock - a yes to «Delete» is n question now names it: «Click on screen at 10, 10 - on «Delete» in Finder» (13w, 13x; 13v holds every lookup, not only the last). Clicking the TEXT inside a button (B7) is judged as the button: the helper now gives a point's pressable ancestor (`control`), so the text in a web chat's Send asks with the recipient and the message (13z1) and the text in «Delete» asks every -time and names it (13z2); an older helper without the field behaves as before. Opera GX, Comet and Dia (Chromium), Orion and +time and names it (13z2); an older helper without the field behaves as before. The ancestor can only make a verdict +stricter, never milder: a nameless icon inside a button called «Open» is still asked about, as it was before (13z3), and a +name the page puts on several lines is shown on one line in the question (13z4). Known cost: the text of a link whose name +looks dangerous («Slut med …», «Delete …») now asks like a click on the link itself, and in a web chat or webmail the text +of a link with a send word, far from the text field, is refused like an untied Send. Opera GX, Comet and Dia (Chromium), Orion and DuckDuckGo (WebKit) and Zen (Gecko) are browsers for both the helper's password-page gate and the send gate - their ids read from Homebrew's cask data, not measured on an installed copy. A search that stopped early now also names the password manager pages it skipped (as not-found already did), and a blur answer says how many windows it reached (`windows_scanned`). The @@ -209,7 +217,7 @@ in the loan's last second is still a stop. A typo keeps the question. The audit you were asked. (`test/skaerm-laan.mjs` 14-16, `test/ikon-menu.mjs` 3f-3h, `test/ikon-boks.mjs` 5z) -## 0.4.0 (in progress) +## 0.4.0 (never published - included in 0.4.1) **A stop lets go of the mouse button and starts nothing new.** A drag holds the button down for up to a few seconds, and a click or a key is down for a moment. From c0066caf42bb4c5f324db78a3afd42fcad773080 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Fri, 6 Nov 2026 16:24:17 +0100 Subject: [PATCH 80/94] release.sh: publish only the helper and status icon the receipt proved FORVENTET_HJAELPER (sha1) and FORVENTET_IKON (tree sum of the .app) are required. A rebuild with other bytes stops the release, unless the archived candidate (HJAELPER_FIL / IKON_APP) matches; it is then copied in with ditto and measured again. No deletion in the script. Opus R18 (R3). Co-Authored-By: Claude Opus 5.5 --- scripts/release.sh | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/scripts/release.sh b/scripts/release.sh index 666f7aa1..6e230fd9 100755 --- a/scripts/release.sh +++ b/scripts/release.sh @@ -5,7 +5,9 @@ # 18/9 stod sitet paa fjorten vaerktoejer mens npm leverede tolv, fordi # udgivelsen var blokeret paa en doed token og alt andet var gaaet videre. # -# Brug: scripts/release.sh 0.2.1 +# Brug: FORVENTET_HJAELPER= FORVENTET_IKON= [HJAELPER_FIL=] [IKON_APP=] \ +# scripts/release.sh 0.4.1 [--tjek] +# Fingeraftrykkene er dem kvitteringen beviste; uden dem udgiver scriptet ikke (Opus R18, 6/11). set -euo pipefail V="${1:?brug: release.sh [--tjek]}" # ⛔ «Klar til at trykke paa knappen» kan ikke bevises af et script der @@ -78,6 +80,25 @@ echo "== 1/7 byg den binaer vi faktisk udsender ==" # MAALT 19/9: kilden fik `wait-for`, og kun en manuel kopi lagde den i vendor. ./scripts/build-release.sh || { echo "⛔ byg fejlede"; exit 1; } [ -x mcp-server/vendor/cmcp-helper ] || { echo "⛔ ingen binaer i vendor/"; exit 1; } +# ⛔ Opus R18 (R3, 6/11): det der udsendes skal VAERE det, kvitteringen beviste (seks Chrome-proever x 2 + ni mutanter), ikke +# blot noget bygget af samme kilde - en genbygning kan give andre bytes (Xcode-opdatering, signaturens UUID). Hjaelperen og +# menulinje-ikonet laases hver paa sit fingeraftryk; giver bygningen andre bytes, laegges den arkiverede kandidat ind, kun hvis +# DENS fingeraftryk passer. Ikonet maales som hele programmappen (eksekverbar + Info.plist + signatur), ikke en enkelt fil; +# ditto overskriver uden at slette, og ligger der rester tilbage, passer fingeraftrykket ikke, og udgivelsen stopper. +traesum() { ( cd "$1" 2>/dev/null && find . -type f -print0 | LC_ALL=C sort -z | xargs -0 shasum ) | shasum | cut -d' ' -f1; } +filsum() { shasum "$1" 2>/dev/null | cut -d' ' -f1; } +laas() { # navn sti-i-vendor maalefunktion forventet arkiveret-kandidat + [ -n "$4" ] || { echo "⛔ $1: det kvitterede fingeraftryk er ikke sat - udgiver ikke"; exit 1; } + local har; har=$($3 "$2") + [ "$har" = "$4" ] && { echo " $1 er den kvitterede: $4"; return; } + [ -n "$5" ] && [ "$($3 "$5")" = "$4" ] || { echo "⛔ $1: bygget $har, kvitteret $4, og den arkiverede passer ikke - udgiver ikke"; exit 1; } + ditto "$5" "$2" + [ "$($3 "$2")" = "$4" ] || { echo "⛔ $1: kopien af den arkiverede passer ikke"; exit 1; } + echo " $1: bygget $har - den kvitterede $4 er lagt ind fra $5" +} +laas hjaelperen mcp-server/vendor/cmcp-helper filsum "${FORVENTET_HJAELPER:-}" "${HJAELPER_FIL:-}" +cp -p mcp-server/vendor/cmcp-helper helper/.build/release/cmcp-helper # proeverne i trin 2 bruger denne sti (build-release.sh:31) +laas ikonet mcp-server/vendor/ComputerMCPStatus.app traesum "${FORVENTET_IKON:-}" "${IKON_APP:-}" # ⛔ MAALT 19/9: den binaer der laa i vendor/ var arm64 ALENE - mens sitet, # README og llms.txt alle tre lovede "a signed universal binary for Apple From cbfc2a945ac7141943be4f11630d6055b6f6bd16 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Fri, 6 Nov 2026 16:24:17 +0100 Subject: [PATCH 81/94] test 15b/15c: wait for the shutdown flag, and require SIGTERM before SIGKILL MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Under load the server could read the new calls before it handled the signal (Opus R18: 8 of 30 red). 15b now waits until a writing call is refused with «shutting down» (at most 500 ms per reply, only while the server lives). The fake helper records the SIGTERM it ignores, so stopOgVent skipping the gentle step (mutant M13) turns 15b and 15c red. M11 (no flag): 5 red, no hang. The precondition now also requires the fake's «klar». Co-Authored-By: Claude Opus 5.5 --- test/falsk-hjaelper.mjs | 7 ++++++- test/skaerm-laan.mjs | 20 ++++++++++++++++---- 2 files changed, 22 insertions(+), 5 deletions(-) diff --git a/test/falsk-hjaelper.mjs b/test/falsk-hjaelper.mjs index 0cdcc8c1..4e62df6f 100644 --- a/test/falsk-hjaelper.mjs +++ b/test/falsk-hjaelper.mjs @@ -97,7 +97,8 @@ try { // naaet - et SIGTERM i hullet draebte attrappen, saa serveren (rigtigt) ikke sendte release-mouse. Nu skriver attrappen // «klar», naar handleren ER sat, og proeven venter paa det. FALSK_TERM_FORSINK (ms) aabner hullet med vilje (kalibrering). if (process.env.FALSK_TERM_FORSINK && SVAR[noegle]._ignorerTerm) await new Promise(r => setTimeout(r, Number(process.env.FALSK_TERM_FORSINK))); - if (SVAR[noegle]._ignorerTerm) process.on('SIGTERM', () => {}); + // R18 (Opus M13): attrappen noterer det SIGTERM den ignorerer - saa en proeve kan kraeve SIGTERM FOER SIGKILL. + if (SVAR[noegle]._ignorerTerm) process.on('SIGTERM', () => { try { appendFileSync(${JSON.stringify(join(dir, 'term.jsonl'))}, JSON.stringify({ argv, ts: Date.now() }) + '\\n'); } catch {} }); appendFileSync(${JSON.stringify(join(dir, 'klar.jsonl'))}, JSON.stringify({ argv, ts: Date.now() }) + '\\n'); await new Promise(r => setTimeout(r, SVAR[noegle]._vent)); } @@ -214,6 +215,10 @@ process.exit(r.status === null ? 1 : r.status); klar(kommando) { try { return readFileSync(join(dir, 'klar.jsonl'), 'utf8').split('\n').filter(Boolean).map(l => JSON.parse(l)).filter(k => k.argv[0] === kommando).length; } catch { return 0; } }, + /// Hvor mange SIGTERM en «_ignorerTerm»-attrap har faaet for en kommando (R18, Opus M13). + termModtaget(kommando) { + try { return readFileSync(join(dir, 'term.jsonl'), 'utf8').split('\n').filter(Boolean).map(l => JSON.parse(l)).filter(k => k.argv[0] === kommando).length; } catch { return 0; } + }, handlingerNaaedeFrem() { const OPSLAG = new Set(HJAELPER_OPSLAG); return this.kald().filter(k => !OPSLAG.has(k.argv[0]) && !k.argv.includes('--dry')); diff --git a/test/skaerm-laan.mjs b/test/skaerm-laan.mjs index 886c57ea..06f77364 100644 --- a/test/skaerm-laan.mjs +++ b/test/skaerm-laan.mjs @@ -528,7 +528,7 @@ for (const [navn, ekstra, uden] of [['uden kontakten', {}, false], ['tastefejl saet({ idle: { idle: 30 } }); const l = await kl.callTool({ name: 'computer_request_screen', arguments: { action: 'request', reason: 'drag a file', minutes: 3 } }); saet({ idle: { idle: 30 }, drag: { _vent: 9000, _ignorerTerm: true, dragged: true } }); - const klar0 = HJ.klar('drag'); + const klar0 = HJ.klar('drag'); const term0 = HJ.termModtaget('drag'); kl.callTool({ name: 'computer_drag', arguments: { fromX: 10, fromY: 10, toX: 50, toY: 50 } }).catch(() => null); const lever = () => { try { return execFileSync('/usr/bin/pgrep', ['-f', `${dirname(HJ.sti)}/[^ ]+ drag`]).toString().trim().split('\n').filter(Boolean).length; } catch { return 0; } }; // 6/11: vent til attrappen HAR sat sin SIGTERM-handler (klar), ikke blot til processen findes - ellers kapløb (15b/15c). @@ -541,7 +541,9 @@ for (const [navn, ekstra, uden] of [['uden kontakten', {}, false], ['tastefejl await vent(300); const slip = HJ.handlingerNaaedeFrem().filter(k => k.argv[0] === 'release-mouse').length - slip0; let serverLever = true; try { process.kill(pid, 0); } catch { serverLever = false; } - check('15c forudsaetning: laanet givet og traekket koerte', !l.isError && foer >= 1, `${JSON.stringify(l.content?.[0]?.text || '').slice(0, 60)} · ${foer}`); + check('15c forudsaetning: laanet givet og traekket koerte (attrappen naaede «klar»)', !l.isError && foer >= 1 && HJ.klar('drag') >= klar0 + 1, `${JSON.stringify(l.content?.[0]?.text || '').slice(0, 60)} · ${foer} · klar ${HJ.klar('drag') - klar0}`); + // R18 (Opus M13 overlevede): stopOgVent skal SIGTERM'e foerst - en rigtig key/type-hjaelper slipper saa sin tast selv. + check('15c ...og traekket fik SIGTERM FOER SIGKILL (stopOgVent springer ikke det blide trin over)', HJ.termModtaget('drag') - term0 >= 1, `${HJ.termModtaget('drag') - term0} SIGTERM`); check('15c en rigtig MCP-klient lukker: traekket draebt og knappen sluppet, og serveren gik selv - allerede da stdin sluttede (foer klientens SIGTERM efter 2 s)', lever() === 0 && slip >= 1 && !serverLever && ms < 1900, `close ${ms} ms · traek lever=${lever()} · release-mouse=${slip} · server lever=${serverLever}`); } finally { try { await kl.close(); } catch {} saet({ idle: { idle: 30 } }); } @@ -760,7 +762,7 @@ for (const [navn, linjer, stop] of [['16h forkert nonce paa «taken-back», saa saet({ idle: { idle: 30 } }); const l = await X.kald('computer_request_screen', { action: 'request', reason: 'drag a file', minutes: 3 }); saet({ idle: { idle: 30 }, drag: { _vent: 9000, _ignorerTerm: true, dragged: true } }); - const klar0 = HJ.klar('drag'); + const klar0 = HJ.klar('drag'); const term0 = HJ.termModtaget('drag'); const kald = X.kald('computer_drag', { fromX: 10, fromY: 10, toX: 50, toY: 50 }).catch(() => null); const lever = () => { try { return execFileSync('/usr/bin/pgrep', ['-f', `${dirname(HJ.sti)}/[^ ]+ drag`]).toString().trim().split('\n').filter(Boolean).length; } catch { return 0; } }; // 6/11: vent til attrappen HAR sat sin SIGTERM-handler (klar), ikke blot til processen findes - ellers kapløb (15b/15c). @@ -768,6 +770,14 @@ for (const [navn, linjer, stop] of [['16h forkert nonce paa «taken-back», saa const slip0 = HJ.handlingerNaaedeFrem().filter(k => k.argv[0] === 'release-mouse').length; const t0 = Date.now(); X.srv.kill('SIGTERM'); + // R18 (Opus, MAALT 8 af 30 roede under belastning): serveren kan laese de nye kald, FOER signalet er haandteret. Vent til et + // skrivende kald AFVISES med «shutting down» (flaget er sat) - kun mens serveren lever, og hoejst 500 ms pr. svar, saa en + // server der aldrig saetter flaget giver roedt, ikke et haeng. Et kald foer flaget maa gerne naa frem; reglen gaelder EFTER. + const serverLever = () => X.srv.exitCode === null && X.srv.signalCode === null; + let flag = null; + for (let i = 0; i < 8 && serverLever() && !/shutting down/.test(flag?.tekst || ''); i++) { + flag = await Promise.race([X.kald('computer_type', { app: 'TextEdit', text: 'proeve' }).then(r => r, e => ({ fejl: true, tekst: String(e) })), vent(500).then(() => ({ tekst: 'intet svar inden 500 ms' }))]); + } const type0 = HJ.handlingerNaaedeFrem().filter(k => k.argv[0] === 'type').length; let nySvar = null; X.kald('computer_type', { app: 'TextEdit', text: 'ny skrivning under nedlukningen' }).then(r => { nySvar = r; }, e => { nySvar = { fejl: true, tekst: String(e) }; }); // R4 (Astra P1) let nyOptag = null; X.kald('computer_record', { action: 'start' }).then(r => { nyOptag = r; }, e => { nyOptag = { fejl: true, tekst: String(e) }; }); // R5 (Opus F1) @@ -777,7 +787,9 @@ for (const [navn, linjer, stop] of [['16h forkert nonce paa «taken-back», saa let serverVaek = false; for (let i = 0; i < 60 && !serverVaek; i++) { await vent(100); serverVaek = X.srv.exitCode !== null || X.srv.signalCode !== null; } const ms = Date.now() - t0; const slip = HJ.handlingerNaaedeFrem().filter(k => k.argv[0] === 'release-mouse').length - slip0; - check('15b forudsaetning: laanet givet og traekket koerte', !l.fejl && foer >= 1, `${l.tekst.slice(0, 60)} · ${foer}`); + check('15b forudsaetning: laanet givet, traekket koerte (attrappen naaede «klar»), og nedlukningsflaget blev sat', !l.fejl && foer >= 1 && HJ.klar('drag') >= klar0 + 1 && /shutting down/.test(flag?.tekst || ''), + `${l.tekst.slice(0, 60)} · ${foer} · klar ${HJ.klar('drag') - klar0} · flag: ${JSON.stringify(flag).slice(0, 100)}`); + check('15b ...og traekket fik SIGTERM FOER SIGKILL (R18, Opus M13)', HJ.termModtaget('drag') - term0 >= 1, `${HJ.termModtaget('drag') - term0} SIGTERM`); check('15b under nedlukningen starter ingen NY skrivende hjaelper - den afvises med «shutting down»', HJ.handlingerNaaedeFrem().filter(k => k.argv[0] === 'type').length === type0 && /shutting down/.test(nySvar?.tekst || ''), `${HJ.handlingerNaaedeFrem().filter(k => k.argv[0] === 'type').length - type0} nye · svar: ${JSON.stringify(nySvar).slice(0, 160)}`); check('15b ...heller ingen NY optagelse - den afvises med «shutting down» (R5, Opus F1)', /shutting down/.test(nyOptag?.tekst || ''), JSON.stringify(nyOptag).slice(0, 160)); From 7ae72deccc8c824867f667b4465f4ec5c8618981 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Fri, 6 Nov 2026 17:50:24 +0100 Subject: [PATCH 82/94] release.sh: the lock survives a clean clone and holds where the package is made Opus R19 B1: helper/.build/ is gitignored, so the copy into it failed in a fresh clone and release-fejlmatrix was red 8/8, which would have stopped the dialog receipt and step 2. B2: the fingerprints are measured again, measure only, right before the tag and right before npm publish (a swap after step 1 was packed with the lock green). The archive fallback now requires HEAD:helper to be the tree the candidate was built from (HJAELPER_TRAE) and refreshes the timestamps, so run-all.sh does not call the proven binary older than its source. The failure matrix sets the fingerprints per scenario and adds S7-S12; each new guard turns exactly its scenario red when removed. Notes that the GitHub asset and .mcpb are CI-built. Co-Authored-By: Claude Opus 5.5 --- scripts/release.sh | 22 +++++++++++++++++- test/release-fejlmatrix.mjs | 45 ++++++++++++++++++++++++++++++------- 2 files changed, 58 insertions(+), 9 deletions(-) diff --git a/scripts/release.sh b/scripts/release.sh index 6e230fd9..baac1a96 100755 --- a/scripts/release.sh +++ b/scripts/release.sh @@ -6,7 +6,7 @@ # udgivelsen var blokeret paa en doed token og alt andet var gaaet videre. # # Brug: FORVENTET_HJAELPER= FORVENTET_IKON= [HJAELPER_FIL=] [IKON_APP=] \ -# scripts/release.sh 0.4.1 [--tjek] +# [HJAELPER_TRAE=] scripts/release.sh 0.4.1 [--tjek] # Fingeraftrykkene er dem kvitteringen beviste; uden dem udgiver scriptet ikke (Opus R18, 6/11). set -euo pipefail V="${1:?brug: release.sh [--tjek]}" @@ -92,13 +92,31 @@ laas() { # navn sti-i-vendor maalefunktion forventet arkiveret-kandidat local har; har=$($3 "$2") [ "$har" = "$4" ] && { echo " $1 er den kvitterede: $4"; return; } [ -n "$5" ] && [ "$($3 "$5")" = "$4" ] || { echo "⛔ $1: bygget $har, kvitteret $4, og den arkiverede passer ikke - udgiver ikke"; exit 1; } + # R19: den arkiverede er kun den rigtige, hvis kilden er den, den blev bygget af - ellers passer maerket ikke til binaeren. + [ -n "${HJAELPER_TRAE:-}" ] && [ "$(git rev-parse HEAD:helper)" = "$HJAELPER_TRAE" ] \ + || { echo "⛔ $1: den arkiverede kandidat laegges kun ind, naar HEAD:helper er traeet den blev bygget af (HJAELPER_TRAE) - udgiver ikke"; exit 1; } ditto "$5" "$2" + # R19: ditto bevarer arkivets tidsstempel, og run-all.sh (trin 2) stopper ved en binaer der er AELDRE end kilden. Indholdet - + # og dermed fingeraftrykket - er uaendret; kun tidsstemplet bliver nu. + find "$2" -exec touch {} + [ "$($3 "$2")" = "$4" ] || { echo "⛔ $1: kopien af den arkiverede passer ikke"; exit 1; } echo " $1: bygget $har - den kvitterede $4 er lagt ind fra $5" } laas hjaelperen mcp-server/vendor/cmcp-helper filsum "${FORVENTET_HJAELPER:-}" "${HJAELPER_FIL:-}" +# Opus R19 B1 (MAALT): `.build/` er gitignored, saa mappen findes ikke i en ren klon - cp'en doede, og run-all.sh blev roed. +mkdir -p helper/.build/release cp -p mcp-server/vendor/cmcp-helper helper/.build/release/cmcp-helper # proeverne i trin 2 bruger denne sti (build-release.sh:31) laas ikonet mcp-server/vendor/ComputerMCPStatus.app traesum "${FORVENTET_IKON:-}" "${IKON_APP:-}" +# Opus R19 B2 (MAALT, scenarie F): laasen ovenfor er et oejeblik. Mellem den og npm ligger suiten, CI-opslag og Touch ID - og +# vendor/ er gitignored, saa trin 0's vagt mod et urent arbejdstrae ser ikke en ombytning. Derfor maales begge igen (kun +# maaling, intet laegges ind) lige foer maerket og lige foer npm pakker. +fastholdt() { + [ "$(filsum mcp-server/vendor/cmcp-helper)" = "$FORVENTET_HJAELPER" ] && [ "$(traesum mcp-server/vendor/ComputerMCPStatus.app)" = "$FORVENTET_IKON" ] \ + || { echo "⛔ $1: hjaelperen eller ikonet i vendor/ er AENDRET siden trin 1 (ikke laengere det kvitterede) - udgiver ikke"; exit 1; } + echo " $1: hjaelperen og ikonet er stadig de kvitterede" +} +# ⛔ Opus R19 B7: laasen gaelder npm-pakken. GitHub-udgivelsens binaer og .mcpb-pakken bygges af CI paa maerket +# (.github/workflows/release.yml) - de er IKKE den kvitterede binaer og er ikke Chrome-proevet. # ⛔ MAALT 19/9: den binaer der laa i vendor/ var arm64 ALENE - mens sitet, # README og llms.txt alle tre lovede "a signed universal binary for Apple @@ -308,6 +326,7 @@ echo "== 5/7 maerk og skub FOER der udgives ==" # udgivelse kan ikke kaldes tilbage. Nu er raekkefoelgen: alt det der kan # fortrydes, foerst. npm whoami >/dev/null 2>&1 || { echo "⛔ npm-tokenen er ikke gyldig. Gustav skal lave en ny (2FA)."; exit 1; } +fastholdt "foer maerket" git tag -a "v$V" -m "v$V" # ⛔ OPUS (2/10): "main" her var meningsløst OG farligt - HEAD er lige verificeret # identisk med origin/main ovenfor, saa der er intet nyt at skubbe til main; @@ -329,6 +348,7 @@ else fi echo "== 6/7 npm ==" +fastholdt "foer npm publish" ( cd mcp-server && npm publish --access public ) # ⛔ 7/10 (panel R2+R8, E): faelden stod armeret gennem deprecate. Et afbrudt deprecate # (Ctrl-C mens browseren venter) rullede PUBLICERET tilbage og skrev «udgivelsen diff --git a/test/release-fejlmatrix.mjs b/test/release-fejlmatrix.mjs index a8449323..29b77b4c 100644 --- a/test/release-fejlmatrix.mjs +++ b/test/release-fejlmatrix.mjs @@ -14,7 +14,7 @@ // Intet naar GitHub, npm eller registret. import './ryd-op.mjs'; // 11/10: mapperne ryddes altid, ogsaa ved dumpet og afbrudt import { execFileSync, spawnSync } from 'node:child_process'; -import { mkdtempSync, writeFileSync, readFileSync, chmodSync, existsSync, cpSync, mkdirSync } from 'node:fs'; +import { mkdtempSync, writeFileSync, readFileSync, chmodSync, existsSync, cpSync, mkdirSync, appendFileSync } from 'node:fs'; import { tmpdir } from 'node:os'; import { join, dirname } from 'node:path'; import { fileURLToPath } from 'node:url'; @@ -23,14 +23,22 @@ const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..'); const fails = []; const check = (l, c, d = '') => { console.log(`${c ? 'OK ' : 'DUMP'} ${l}${d ? ' - ' + d : ''}`); if (!c) fails.push(l); }; -if (!existsSync(join(ROOT, 'mcp-server', 'vendor', 'cmcp-helper'))) { - console.log('SPR. fejlmatricen - mcp-server/vendor/cmcp-helper mangler (koer scripts/build-release.sh); umaalt, ikke bestaaet'); +if (!existsSync(join(ROOT, 'mcp-server', 'vendor', 'cmcp-helper')) || !existsSync(join(ROOT, 'mcp-server', 'vendor', 'ComputerMCPStatus.app'))) { + console.log('SPR. fejlmatricen - mcp-server/vendor/cmcp-helper eller ComputerMCPStatus.app mangler (koer scripts/build-release.sh); umaalt, ikke bestaaet'); process.exit(0); } const V = JSON.parse(readFileSync(join(ROOT, 'mcp-server', 'package.json'), 'utf8')).version; const GIT = execFileSync('/bin/sh', ['-c', 'command -v git'], { encoding: 'utf8' }).trim(); +// Opus R19 B1: release.sh udgiver kun med de kvitterede fingeraftryk. Proeven udleder dem af den vendor/ den selv kopierer ind - +// med SAMME formel som release.sh (traesum), saa en drift i formlen goer S5 roed. Operatoerens egne arkiv-variabler nulstilles: +// under en aegte udgivelse koerer denne proeve i trin 2 med HJAELPER_FIL m.fl. i miljoeet, og de maa ikke redde S8. +const FP_H = execFileSync('/bin/sh', ['-c', 'shasum mcp-server/vendor/cmcp-helper | cut -d" " -f1'], { cwd: ROOT, encoding: 'utf8' }).trim(); +const FP_I = execFileSync('/bin/bash', ['-c', '( cd mcp-server/vendor/ComputerMCPStatus.app && find . -type f -print0 | LC_ALL=C sort -z | xargs -0 shasum ) | shasum | cut -d" " -f1'], { cwd: ROOT, encoding: 'utf8' }).trim(); +const TRAE = execFileSync(GIT, ['rev-parse', 'HEAD:helper'], { cwd: ROOT, encoding: 'utf8' }).trim(); +const HJ_ARKIV = join(ROOT, 'mcp-server', 'vendor', 'cmcp-helper'); +const anden = (K) => appendFileSync(join(K, 'mcp-server', 'vendor', 'cmcp-helper'), 'x'); // samme binaer + én byte = en anden -function scenarie(navn, { gh = {}, npm = {}, git = {} } = {}) { +function scenarie(navn, { gh = {}, npm = {}, git = {}, env = {}, foer = null, runAll = 'exit 0' } = {}) { const D = mkdtempSync(join(tmpdir(), `cmcp-rel-${navn}-`)); const BARE = join(D, 'origin.git'), K = join(D, 'repo'), BIN = join(D, 'bin'), LOG = join(D, 'kald.log'); mkdirSync(BIN); @@ -38,7 +46,7 @@ function scenarie(navn, { gh = {}, npm = {}, git = {} } = {}) { // Proeven skal maale release.sh som det staar i arbejdstraeet, ogsaa foer commit. cpSync(join(ROOT, 'scripts', 'release.sh'), join(K, 'scripts', 'release.sh')); writeFileSync(join(K, 'scripts', 'build-release.sh'), '#!/bin/sh\nexit 0\n'); - writeFileSync(join(K, 'test', 'run-all.sh'), '#!/bin/sh\nexit 0\n'); + writeFileSync(join(K, 'test', 'run-all.sh'), `#!/bin/sh\n${runAll}\n`); chmodSync(join(K, 'scripts', 'build-release.sh'), 0o755); chmodSync(join(K, 'test', 'run-all.sh'), 0o755); const gitK = (...a) => execFileSync(GIT, a, { cwd: K, stdio: 'pipe', encoding: 'utf8' }); gitK('-c', 'user.name=p', '-c', 'user.email=p@example.invalid', 'commit', '-qam', 'proeve: stubbe'); @@ -48,6 +56,7 @@ function scenarie(navn, { gh = {}, npm = {}, git = {} } = {}) { gitK('branch', '-q', '-u', 'origin/main'); for (const t of gitK('tag', '-l').split('\n').filter(Boolean)) gitK('tag', '-d', t); cpSync(join(ROOT, 'mcp-server', 'vendor'), join(K, 'mcp-server', 'vendor'), { recursive: true }); + if (foer) foer(K); const fp = execFileSync('/bin/sh', ['-c', 'cat mcp-server/policy.js test/failclosed.mjs | shasum -a 256 | cut -c1-16'], { cwd: K, encoding: 'utf8' }).trim(); writeFileSync(join(K, '.dialog-kvittering'), `${fp} 2026-10-07T00:00:00Z\n`); @@ -61,7 +70,7 @@ function scenarie(navn, { gh = {}, npm = {}, git = {} } = {}) { esac`); stub('npm', `case "$1" in whoami) echo proever ;; - publish) ${npm.publish ?? 'exit 0'} ;; + publish) shasum vendor/cmcp-helper | cut -c1-40 > ${join(D, 'publish-sha')}; ${npm.publish ?? 'exit 0'} ;; deprecate) ${npm.deprecate ?? 'exit 0'} ;; *) exec /usr/bin/env -u PATH npm "$@" ;; esac`); @@ -71,10 +80,12 @@ esac`); const r = spawnSync('bash', ['scripts/release.sh', V], { cwd: K, encoding: 'utf8', timeout: 300000, env: { ...process.env, PATH: `${BIN}:${process.env.PATH}`, GIT_AUTHOR_NAME: 'p', GIT_AUTHOR_EMAIL: 'p@example.invalid', - GIT_COMMITTER_NAME: 'p', GIT_COMMITTER_EMAIL: 'p@example.invalid' } }); + GIT_COMMITTER_NAME: 'p', GIT_COMMITTER_EMAIL: 'p@example.invalid', + FORVENTET_HJAELPER: FP_H, FORVENTET_IKON: FP_I, HJAELPER_FIL: '', IKON_APP: '', HJAELPER_TRAE: '', ...env } }); const kald = existsSync(LOG) ? readFileSync(LOG, 'utf8') : ''; const fjernTag = spawnSync(GIT, ['ls-remote', '--tags', BARE, `refs/tags/v${V}`], { encoding: 'utf8' }).stdout.trim(); - return { rc: r.status, ud: (r.stdout || '') + (r.stderr || ''), kald, fjernTag, publiceret: readFileSync(join(K, 'PUBLICERET'), 'utf8').trim() }; + const publishSha = existsSync(join(D, 'publish-sha')) ? readFileSync(join(D, 'publish-sha'), 'utf8').trim() : ''; + return { rc: r.status, ud: (r.stdout || '') + (r.stderr || ''), kald, fjernTag, publishSha, publiceret: readFileSync(join(K, 'PUBLICERET'), 'utf8').trim() }; } // S1: GitHub svarer ikke paa CI-forespoergslen -> UKENDT, intet maerket. @@ -111,5 +122,23 @@ const raek = ['gh release create', 'npm publish', 'npm deprecate', 'gh pr create check('S5 alt groent: rc 0, maerke paa origin, raekkefoelgen release -> publish -> deprecate -> PR -> register', s5.rc === 0 && !!s5.fjernTag && raek.every(i => i >= 0) && raek.every((v, i) => i === 0 || v > raek[i - 1]), `rc=${s5.rc} ${raek.join(',')}`); +check('S5 ...og npm pakkede netop den kvitterede hjaelper', s5.publishSha === FP_H, `${s5.publishSha.slice(0, 8)} mod ${FP_H.slice(0, 8)}`); + +// S7-S12 (Opus R18 R3 + R19 B1/B2): release.sh udgiver kun det, kvitteringen beviste - og det maales igen, hvor pakken dannes. +const stopLinje = (s) => (s.ud.match(/⛔[^\n]*/) || ['(ingen ⛔)'])[0].slice(0, 110); +const s7 = scenarie('laas-ikke-sat', { env: { FORVENTET_HJAELPER: '' } }); +check('S7 intet kvitteret fingeraftryk: stopper i trin 1, intet maerke, intet npm', s7.rc !== 0 && /fingeraftryk er ikke sat/.test(s7.ud) && !s7.fjernTag && !/npm publish/.test(s7.kald), stopLinje(s7)); +const s8 = scenarie('laas-anden', { foer: anden }); +check('S8 en anden hjaelper end den kvitterede og intet arkiv: stopper i trin 1', s8.rc !== 0 && /kvitteret/.test(s8.ud) && !s8.fjernTag && !/npm publish/.test(s8.kald), stopLinje(s8)); +const s9 = scenarie('laas-arkiv', { foer: anden, env: { HJAELPER_FIL: HJ_ARKIV, HJAELPER_TRAE: TRAE } }); +check('S9 en anden hjaelper, men arkivet passer: den kvitterede laegges ind, og npm pakker netop den', s9.rc === 0 && s9.publishSha === FP_H && /er lagt ind fra/.test(s9.ud), + `rc=${s9.rc} · pakket ${s9.publishSha.slice(0, 8)} · ${stopLinje(s9)}`); +const s11 = scenarie('arkiv-forkert-trae', { foer: anden, env: { HJAELPER_FIL: HJ_ARKIV, HJAELPER_TRAE: '0'.repeat(40) } }); +check('S11 arkivet passer, men kilden er ikke den det blev bygget af: stopper, intet npm', s11.rc !== 0 && /HJAELPER_TRAE/.test(s11.ud) && !/npm publish/.test(s11.kald), stopLinje(s11)); +const s10 = scenarie('ombyttet-foer-maerket', { runAll: 'printf x >> mcp-server/vendor/cmcp-helper\nexit 0' }); +check('S10 hjaelperen ombyttet EFTER trin 1 (under suiten): stopper foer maerket, intet npm', s10.rc !== 0 && /foer maerket: .*AENDRET siden trin 1/.test(s10.ud) && !s10.fjernTag && !/npm publish/.test(s10.kald), stopLinje(s10)); +const s12 = scenarie('ombyttet-foer-npm', { gh: { releaseCreate: 'printf x >> mcp-server/vendor/cmcp-helper; exit 0' } }); +check('S12 hjaelperen ombyttet efter maerket: stopper foer npm publish', s12.rc !== 0 && /foer npm publish: .*AENDRET siden trin 1/.test(s12.ud) && !/npm publish/.test(s12.kald), stopLinje(s12)); + console.log(fails.length ? `DUMPET: ${fails.length} tjek` : 'Alle tjek bestået.'); process.exit(fails.length ? 1 : 0); From fe987717a043c29a547ca61d570a1deab2a217ab Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Fri, 6 Nov 2026 17:50:24 +0100 Subject: [PATCH 83/94] Send verdict: a name needs a letter or a digit MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Opus R19 B4: a space, a line break or an invisible mark (U+200E, aria-label=" ") counted as a name, which switched off the «we don't know what this is» rule. One shared rule (harNavn) now decides it for the danger gate, the send gate, the unnamed check and the name in the question. Danger words are words, so this can only make a verdict stricter. Tests 13z5-13z8, red under the old filter. CHANGELOG also names the new known cost: a named element inside a nameless button is now asked about. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 9 ++++++--- mcp-server/index.js | 12 ++++++++---- test/bundet-maal.mjs | 6 ++++++ 3 files changed, 20 insertions(+), 7 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 8175fbda..115baa49 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -155,9 +155,12 @@ the last). Clicking the TEXT inside a button (B7) is judged as the button: the h (`control`), so the text in a web chat's Send asks with the recipient and the message (13z1) and the text in «Delete» asks every time and names it (13z2); an older helper without the field behaves as before. The ancestor can only make a verdict stricter, never milder: a nameless icon inside a button called «Open» is still asked about, as it was before (13z3), and a -name the page puts on several lines is shown on one line in the question (13z4). Known cost: the text of a link whose name -looks dangerous («Slut med …», «Delete …») now asks like a click on the link itself, and in a web chat or webmail the text -of a link with a send word, far from the text field, is refused like an untied Send. Opera GX, Comet and Dia (Chromium), Orion and +name the page puts on several lines is shown on one line in the question (13z4). A name is only a name when it has a +letter or a digit: a space, a line break or an invisible mark (`aria-label=" "`, U+200E) no longer counts, so it cannot +switch off the «we don't know what this is» rule (13z5-13z8). Known cost: the text of a link whose name +looks dangerous («Slut med …», «Delete …») now asks like a click on the link itself, in a web chat or webmail the text +of a link with a send word, far from the text field, is refused like an untied Send, and a named element inside a +button that has no name (common in Electron and web apps) is now asked about too. Opera GX, Comet and Dia (Chromium), Orion and DuckDuckGo (WebKit) and Zen (Gecko) are browsers for both the helper's password-page gate and the send gate - their ids read from Homebrew's cask data, not measured on an installed copy. A search that stopped early now also names the password manager pages it skipped (as not-found already did), and a blur answer says how many windows it reached (`windows_scanned`). The diff --git a/mcp-server/index.js b/mcp-server/index.js index e6e9c06a..fa8ed607 100644 --- a/mcp-server/index.js +++ b/mcp-server/index.js @@ -700,11 +700,15 @@ async function trykForhaand(args) { const KLIK_LIG = (name) => name === 'computer_click' || name === 'computer_drag'; const klikPunkt = (name, args) => name === 'computer_drag' ? [args.fromX, args.fromY] : [args.x, args.y]; +// Opus R19 B4 (MAALT): et navn af mellemrum, linjeskift eller usynlige tegn (U+200E, aria-label=" ") talte som et NAVN i +// fare-porten, saa «vi ved ikke hvad det er» blev slaaet fra af ét mellemrum. Et navn er kun et navn med bogstaver eller cifre; +// fareordene er ord, saa intet navn uden bogstaver kunne alligevel goere noget farligt - reglen goer kun dommen strengere. +const harNavn = (x) => /[\p{L}\p{N}]/u.test(String(x ?? '')); // Hvordan et element under et klik naevnes for mennesket: titel, ellers beskrivelse, ellers rollen. function knapNavn(e) { const k = forfader(e); // Opus R17 O3 (MAALT): sidens tekst gik raa ind i dialogen («Delete\n\nThis is a harmless …»). Nu én linje. - const n = String(e?.title || e?.description || k?.title || k?.description || '').replace(/\s+/g, ' ').trim(); + const n = String([e?.title, e?.description, k?.title, k?.description].find(harNavn) || '').replace(/\s+/g, ' ').trim(); return n ? `«${n.slice(0, 80)}»` : `an unnamed ${String(k?.role || e?.role || 'element').replace(/^AX/, '').toLowerCase()}`; } // Foer npm (B7, Opus R11-O4): hjaelperen giver den trykbare forfader til en tekst/et billede i en knap (`control`). En aeldre @@ -725,7 +729,7 @@ async function knapErFarlig(name, args, appKlik = null, forhaand = null) { if (d.password_page) return true; // Opus R17 O1 (MAALT): forfaderen ERSTATTEDE elementets uvished - et navnloest ikon i en knap «Open» blev ufarligt og klikket // uden spoergsmaal. Nu er dommen MONOTON: elementets egen dom gaelder, og forfaderen kan kun laegge fare oveni. - const egen = (navne, rolle) => { const n = navne.filter(Boolean); return n.length ? n.some(x => menuSerFarlig(x)) : kanVaereKnap(rolle); }; + const egen = (navne, rolle) => { const n = navne.filter(harNavn); return n.length ? n.some(x => menuSerFarlig(x)) : kanVaereKnap(rolle); }; const c = forfader(d); return egen([d.title, d.description], d.role) || (c ? egen([c.title, c.description], c.role) : false); } catch { return true; } @@ -785,7 +789,7 @@ async function sendeDom(name, args, bid, appKlik = null, forhaand = null) { // Ved et KLIK er et navnloest element kun en mulig send-knap hvis det er en knap eller // et billede - i Electron-apps rammer et klik ofte en navnloes gruppe (Fable R2 2). const navnSender = (navne, rolle = '', klik = false) => { - const n = navne.filter(Boolean).join(' ').trim(); + const n = navne.filter(harNavn).join(' ').trim(); // R19 B4 if (n) return SENDE_ORD.test(n); // Runde 3 (Astra 3): en UKENDT rolle er ogsaa ved et klik en mulig send - kun // en KENDT ufarlig rolle (fx AXGroup) er undtaget. @@ -819,7 +823,7 @@ async function sendeDom(name, args, bid, appKlik = null, forhaand = null) { || (k.forfader ? navnSender(k.forfader.navne, k.forfader.rolle, KLIK_LIG(name)) : false); knapVindue = k.vindue; knapRamme = k.ramme; // Foer npm (Opus R12 X5): et NAVNLOEST element (fx et billede man traekker ud af en chat) kaldtes «the Send control». - navnloes = !k.fundet || k.andetProgram || ![...k.navne, ...(k.forfader?.navne || [])].filter(Boolean).join(' ').trim(); + navnloes = !k.fundet || k.andetProgram || ![...k.navne, ...(k.forfader?.navne || [])].some(harNavn); } } if (!sender) return null; diff --git a/test/bundet-maal.mjs b/test/bundet-maal.mjs index 71b51d46..0fca8596 100644 --- a/test/bundet-maal.mjs +++ b/test/bundet-maal.mjs @@ -714,6 +714,12 @@ for (const [nr, tekst, args, rolle] of [ for (const [id, hvad, el, dom] of [ ['13z3', 'navnloest ikon i en knap «Open»: spoerges stadig (forfaderen goer det ikke ufarligt)', IKON, (sp) => sp.length >= 1], ['13z4', 'knapnavn med linjeskift: én linje i spoergsmaalet', FLER, (sp) => sp.some(t => /«Delete This is a harmless read-only click\.»/.test(t)) && !sp.some(t => /«Delete\n/.test(t))], + // Opus R19 B4 (MAALT): et «navn» uden bogstaver eller cifre slog fare-porten fra - et mellemrum, et usynligt tegn eller et + // linjeskift i ikonets titel, eller en knap hvis eget navn er ét mellemrum (aria-label=" "). + ['13z5', 'ikon med MELLEMRUM som titel i en knap «Open»: spoerges', { ...IKON, title: ' ' }, (sp) => sp.length >= 1], + ['13z6', 'ikon med et usynligt tegn (U+200E) som titel i en knap «Open»: spoerges', { ...IKON, title: '\u200E' }, (sp) => sp.length >= 1], + ['13z7', 'ikon med et linjeskift som titel i en knap «Open»: spoerges', { ...IKON, title: '\n' }, (sp) => sp.length >= 1], + ['13z8', 'navnloes tekst i en knap hvis navn er ét mellemrum: spoerges', { ...IKON, role: 'AXStaticText', control: { role: 'AXButton', title: ' ', description: '' } }, (sp) => sp.length >= 1], ]) { const sp = lavFalskSpoerger('ja', 'cmcp-bundet-o1'); const { srv, rpc, kald } = klient({ apps: APPSF, at: el }, { CMCP_BACKGROUND: '0', CMCP_OSASCRIPT: sp.sti }); From 4ac2797faa552b1e9423e2cd8c932af5e4d073c7 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Fri, 6 Nov 2026 17:50:24 +0100 Subject: [PATCH 84/94] test 15b: take the zero point before the signal Opus R19 Q3: counted after the wait loop, a writing helper started inside the window would land in the zero point. Now any such helper counts as a breach. Co-Authored-By: Claude Opus 5.5 --- test/skaerm-laan.mjs | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/test/skaerm-laan.mjs b/test/skaerm-laan.mjs index 06f77364..f24a4222 100644 --- a/test/skaerm-laan.mjs +++ b/test/skaerm-laan.mjs @@ -769,6 +769,8 @@ for (const [navn, linjer, stop] of [['16h forkert nonce paa «taken-back», saa let foer = 0; for (let i = 0; i < 50 && !(foer && HJ.klar('drag') >= klar0 + 1); i++) { await vent(100); foer = lever(); } const slip0 = HJ.handlingerNaaedeFrem().filter(k => k.argv[0] === 'release-mouse').length; const t0 = Date.now(); + // R19 (Opus Q3): nulpunktet tages FOER signalet - saa taeller enhver skrivende hjaelper startet i ventevinduet som et brud. + const type0 = HJ.handlingerNaaedeFrem().filter(k => k.argv[0] === 'type').length; X.srv.kill('SIGTERM'); // R18 (Opus, MAALT 8 af 30 roede under belastning): serveren kan laese de nye kald, FOER signalet er haandteret. Vent til et // skrivende kald AFVISES med «shutting down» (flaget er sat) - kun mens serveren lever, og hoejst 500 ms pr. svar, saa en @@ -778,7 +780,6 @@ for (const [navn, linjer, stop] of [['16h forkert nonce paa «taken-back», saa for (let i = 0; i < 8 && serverLever() && !/shutting down/.test(flag?.tekst || ''); i++) { flag = await Promise.race([X.kald('computer_type', { app: 'TextEdit', text: 'proeve' }).then(r => r, e => ({ fejl: true, tekst: String(e) })), vent(500).then(() => ({ tekst: 'intet svar inden 500 ms' }))]); } - const type0 = HJ.handlingerNaaedeFrem().filter(k => k.argv[0] === 'type').length; let nySvar = null; X.kald('computer_type', { app: 'TextEdit', text: 'ny skrivning under nedlukningen' }).then(r => { nySvar = r; }, e => { nySvar = { fejl: true, tekst: String(e) }; }); // R4 (Astra P1) let nyOptag = null; X.kald('computer_record', { action: 'start' }).then(r => { nyOptag = r; }, e => { nyOptag = { fejl: true, tekst: String(e) }; }); // R5 (Opus F1) // R6 (Opus M1/M4 overlevede): en NY laanebegaering afvises ogsaa - men et opslag svarer stadig. From 785a1744297fbf48a7827e5cecc118c4111667e6 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Fri, 6 Nov 2026 19:11:26 +0100 Subject: [PATCH 85/94] release.sh: measure the package npm sends, and the whole tree, not two files MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Opus R20 (measured twice): npm packs the working tree, so another mcp-server/index.js was published under the proven tag with both binary locks green. The tree's state (names and content) after step 0 is now a snapshot that fastholdt requires unchanged before the tag and before npm. The script now packs the release itself, measures the helper and icon inside the tarball (bytes, x-bit, no symlink) and publishes exactly that tarball; package.json has no prepack or prepublishOnly, so nothing is skipped. An unknown second argument stops: «—tjek» with a long dash gave a full release. The matrix's npm stub now passes through to the real npm («env -u PATH npm» never found it) and measures inside the tarball; S13-S16 cover the tree, the long dash, a symlinked helper and the archive's timestamp against a real stale-binary guard. Co-Authored-By: Claude Opus 5.5 --- scripts/release.sh | 24 +++++++++++++++++++++++- test/release-fejlmatrix.mjs | 26 +++++++++++++++++++++----- 2 files changed, 44 insertions(+), 6 deletions(-) diff --git a/scripts/release.sh b/scripts/release.sh index baac1a96..1604644a 100755 --- a/scripts/release.sh +++ b/scripts/release.sh @@ -16,6 +16,11 @@ V="${1:?brug: release.sh [--tjek]}" # og saa stopper den FOER foerste skridt der forlader maskinen. KUN_TJEK=0 [ "${2:-}" = "--tjek" ] && KUN_TJEK=1 +# ⛔ Opus R20 (MAALT): «—tjek» med lang tankestreg (autokorrektur paa en dansk Mac) blev ikke genkendt og gav en FULD, +# uigenkaldelig udgivelse. Et ukendt argument er et stop, ikke et ja. +if [ $# -gt 2 ] || { [ -n "${2:-}" ] && [ "$2" != "--tjek" ]; }; then + echo "⛔ ukendt argument «${2:-} ${3:-}» - kun --tjek (to almindelige bindestreger) kendes. Udgiver ikke."; exit 1 +fi cd "$(dirname "$0")/.." # FUNDET AF SIKKERHEDSREVIEWET 20/9: mine egne tilfoejelser i dag brugte # $ROOT seks steder - og den blev aldrig sat. Med set -u doer scriptet @@ -71,6 +76,11 @@ fi echo "== 0/7 teksten skal beskrive DEN version vi udgiver ==" echo "$V" > "$ROOT/PUBLICERET" python3 "$ROOT/scripts/sync-tal.py" | sed 's/^/ /' +# ⛔ Opus R20 (MAALT, to gange): trin 0's vagt mod et urent trae koerer EEN gang, og npm pakker arbejdstraeet. En anden +# mcp-server/index.js kom ud under det kvitterede maerke, med begge binaer-laase groenne. Traeets tilstand (navne + indhold) +# efter sync-tal er nu et oejebliksbillede, som `fastholdt` kraever uaendret foer maerket og foer npm. +traetilstand() { { git status --porcelain; git diff HEAD --binary; } | shasum | cut -d' ' -f1; } +RENT0=$(traetilstand) echo "== 1/7 byg den binaer vi faktisk udsender ==" # ⛔ Y3a. `mcp-server/vendor/` er gitignored: binaeren er IKKE i et commit, den @@ -111,6 +121,7 @@ laas ikonet mcp-server/vendor/ComputerMCPStatus.app traesum "${FORVENTET_IKON:-} # vendor/ er gitignored, saa trin 0's vagt mod et urent arbejdstrae ser ikke en ombytning. Derfor maales begge igen (kun # maaling, intet laegges ind) lige foer maerket og lige foer npm pakker. fastholdt() { + [ "$(traetilstand)" = "$RENT0" ] || { echo "⛔ $1: filer i arbejdstraeet er AENDRET siden trin 0 (npm pakker arbejdstraeet) - udgiver ikke:"; git status --short | sed 's/^/ /'; exit 1; } [ "$(filsum mcp-server/vendor/cmcp-helper)" = "$FORVENTET_HJAELPER" ] && [ "$(traesum mcp-server/vendor/ComputerMCPStatus.app)" = "$FORVENTET_IKON" ] \ || { echo "⛔ $1: hjaelperen eller ikonet i vendor/ er AENDRET siden trin 1 (ikke laengere det kvitterede) - udgiver ikke"; exit 1; } echo " $1: hjaelperen og ikonet er stadig de kvitterede" @@ -349,7 +360,18 @@ fi echo "== 6/7 npm ==" fastholdt "foer npm publish" -( cd mcp-server && npm publish --access public ) +# ⛔ Opus R20 (MAALT): `fastholdt` maaler filerne paa disken; npm udsender en PAKKE. Et symlink gav en pakke uden hjaelper med +# begge laase groenne, og en manglende x-bit gik igennem traesummen. Nu pakkes der her, PAKKEN maales, og netop den udgives +# (package.json har ingen prepack/prepublishOnly, saa intet trin springes over af at udgive en faerdig pakke). +PAKKE=$(mktemp -d "${TMPDIR:-/tmp}/cmcp-pakke-XXXXXX") +( cd mcp-server && npm pack --pack-destination "$PAKKE" >/dev/null ) +TGZ=$(ls "$PAKKE"/*.tgz); tar -xzf "$TGZ" -C "$PAKKE" +PH="$PAKKE/package/vendor/cmcp-helper"; PI="$PAKKE/package/vendor/ComputerMCPStatus.app" +[ -f "$PH" ] && [ ! -L "$PH" ] && [ -x "$PH" ] && [ "$(filsum "$PH")" = "$FORVENTET_HJAELPER" ] \ + && [ -x "$PI/Contents/MacOS/cmcp-status" ] && [ "$(traesum "$PI")" = "$FORVENTET_IKON" ] \ + || { echo "⛔ pakken npm ville udsende ($TGZ) har ikke den kvitterede hjaelper og det kvitterede ikon (med x-bit) - udgiver ikke"; exit 1; } +echo " pakken er maalt: hjaelperen og ikonet i den er de kvitterede" +( cd mcp-server && npm publish "$TGZ" --access public ) # ⛔ 7/10 (panel R2+R8, E): faelden stod armeret gennem deprecate. Et afbrudt deprecate # (Ctrl-C mens browseren venter) rullede PUBLICERET tilbage og skrev «udgivelsen # skete ikke» - EFTER en lykket publish. Nu er den afvaebnet i samme sekund. diff --git a/test/release-fejlmatrix.mjs b/test/release-fejlmatrix.mjs index 29b77b4c..415207f2 100644 --- a/test/release-fejlmatrix.mjs +++ b/test/release-fejlmatrix.mjs @@ -14,7 +14,7 @@ // Intet naar GitHub, npm eller registret. import './ryd-op.mjs'; // 11/10: mapperne ryddes altid, ogsaa ved dumpet og afbrudt import { execFileSync, spawnSync } from 'node:child_process'; -import { mkdtempSync, writeFileSync, readFileSync, chmodSync, existsSync, cpSync, mkdirSync, appendFileSync } from 'node:fs'; +import { mkdtempSync, writeFileSync, readFileSync, chmodSync, existsSync, cpSync, mkdirSync, appendFileSync, copyFileSync, utimesSync } from 'node:fs'; import { tmpdir } from 'node:os'; import { join, dirname } from 'node:path'; import { fileURLToPath } from 'node:url'; @@ -29,6 +29,7 @@ if (!existsSync(join(ROOT, 'mcp-server', 'vendor', 'cmcp-helper')) || !existsSyn } const V = JSON.parse(readFileSync(join(ROOT, 'mcp-server', 'package.json'), 'utf8')).version; const GIT = execFileSync('/bin/sh', ['-c', 'command -v git'], { encoding: 'utf8' }).trim(); +const NPM = execFileSync('/bin/sh', ['-c', 'command -v npm'], { encoding: 'utf8' }).trim(); // Opus R19 B1: release.sh udgiver kun med de kvitterede fingeraftryk. Proeven udleder dem af den vendor/ den selv kopierer ind - // med SAMME formel som release.sh (traesum), saa en drift i formlen goer S5 roed. Operatoerens egne arkiv-variabler nulstilles: // under en aegte udgivelse koerer denne proeve i trin 2 med HJAELPER_FIL m.fl. i miljoeet, og de maa ikke redde S8. @@ -38,7 +39,7 @@ const TRAE = execFileSync(GIT, ['rev-parse', 'HEAD:helper'], { cwd: ROOT, encodi const HJ_ARKIV = join(ROOT, 'mcp-server', 'vendor', 'cmcp-helper'); const anden = (K) => appendFileSync(join(K, 'mcp-server', 'vendor', 'cmcp-helper'), 'x'); // samme binaer + én byte = en anden -function scenarie(navn, { gh = {}, npm = {}, git = {}, env = {}, foer = null, runAll = 'exit 0' } = {}) { +function scenarie(navn, { gh = {}, npm = {}, git = {}, env = {}, foer = null, runAll = 'exit 0', args = [] } = {}) { const D = mkdtempSync(join(tmpdir(), `cmcp-rel-${navn}-`)); const BARE = join(D, 'origin.git'), K = join(D, 'repo'), BIN = join(D, 'bin'), LOG = join(D, 'kald.log'); mkdirSync(BIN); @@ -70,15 +71,15 @@ function scenarie(navn, { gh = {}, npm = {}, git = {}, env = {}, foer = null, ru esac`); stub('npm', `case "$1" in whoami) echo proever ;; - publish) shasum vendor/cmcp-helper | cut -c1-40 > ${join(D, 'publish-sha')}; ${npm.publish ?? 'exit 0'} ;; + publish) if [ -f "$2" ]; then tar -xzOf "$2" package/vendor/cmcp-helper | shasum | cut -c1-40; else shasum vendor/cmcp-helper | cut -c1-40; fi > ${join(D, 'publish-sha')}; ${npm.publish ?? 'exit 0'} ;; deprecate) ${npm.deprecate ?? 'exit 0'} ;; - *) exec /usr/bin/env -u PATH npm "$@" ;; + *) exec ${NPM} "$@" ;; # R20: den rigtige npm (fx \`npm pack\`); \`env -u PATH npm\` fandt den aldrig (rc 127) esac`); stub('mcp-publisher', 'exit 0'); writeFileSync(join(BIN, 'git'), `#!/bin/sh\nif [ "$1" = "ls-remote" ] && [ -n "${git.lsRemoteFejl ?? ''}" ]; then exit ${git.lsRemoteFejl ?? 0}; fi\nexec ${GIT} "$@"\n`); chmodSync(join(BIN, 'git'), 0o755); - const r = spawnSync('bash', ['scripts/release.sh', V], { cwd: K, encoding: 'utf8', timeout: 300000, + const r = spawnSync('bash', ['scripts/release.sh', V, ...args], { cwd: K, encoding: 'utf8', timeout: 300000, env: { ...process.env, PATH: `${BIN}:${process.env.PATH}`, GIT_AUTHOR_NAME: 'p', GIT_AUTHOR_EMAIL: 'p@example.invalid', GIT_COMMITTER_NAME: 'p', GIT_COMMITTER_EMAIL: 'p@example.invalid', FORVENTET_HJAELPER: FP_H, FORVENTET_IKON: FP_I, HJAELPER_FIL: '', IKON_APP: '', HJAELPER_TRAE: '', ...env } }); @@ -140,5 +141,20 @@ check('S10 hjaelperen ombyttet EFTER trin 1 (under suiten): stopper foer maerket const s12 = scenarie('ombyttet-foer-npm', { gh: { releaseCreate: 'printf x >> mcp-server/vendor/cmcp-helper; exit 0' } }); check('S12 hjaelperen ombyttet efter maerket: stopper foer npm publish', s12.rc !== 0 && /foer npm publish: .*AENDRET siden trin 1/.test(s12.ud) && !/npm publish/.test(s12.kald), stopLinje(s12)); +// S13-S16 (Opus R20, MAALT): npm pakker arbejdstraeet og udsender en PAKKE - ikke de to filer i vendor/. +const s13 = scenarie('index-aendret', { runAll: "printf '// ombyttet\\n' >> mcp-server/index.js\nexit 0" }); +check('S13 mcp-server/index.js aendret under suiten: stopper foer maerket, intet npm', s13.rc !== 0 && /foer maerket: filer i arbejdstraeet er AENDRET/.test(s13.ud) && !s13.fjernTag && !/npm publish/.test(s13.kald), stopLinje(s13)); +const s14 = scenarie('lang-tankestreg', { args: ['\u2014tjek'] }); +check('S14 «—tjek» (lang tankestreg) er et stop, ikke en udgivelse', s14.rc !== 0 && /ukendt argument/.test(s14.ud) && !s14.fjernTag && !/npm publish/.test(s14.kald), stopLinje(s14)); +const s15 = scenarie('symlink', { runAll: 'mv mcp-server/vendor/cmcp-helper mcp-server/vendor/ekte && ln -s ekte mcp-server/vendor/cmcp-helper\nexit 0' }); +check('S15 hjaelperen byttet til et symlink (samme bytes): pakken maales og stopper, intet npm', s15.rc !== 0 && /pakken npm ville udsende/.test(s15.ud) && !/npm publish/.test(s15.kald), stopLinje(s15)); +// S16: arkivvejens `touch` - med en AEGTE foraeldet-binaer-vagt i trin 2 (som run-all.sh's) og et arkiv med gammelt tidsstempel. +const GAMMEL = join(mkdtempSync(join(tmpdir(), 'cmcp-rel-arkiv-')), 'cmcp-helper'); +copyFileSync(HJ_ARKIV, GAMMEL); chmodSync(GAMMEL, 0o755); utimesSync(GAMMEL, new Date('2000-01-01'), new Date('2000-01-01')); +const s16 = scenarie('arkiv-tidsstempel', { foer: anden, env: { HJAELPER_FIL: GAMMEL, HJAELPER_TRAE: TRAE }, + runAll: '[ -z "$(find helper/Sources -name \'*.swift\' -newer mcp-server/vendor/cmcp-helper | head -1)" ] || { echo "GAMMEL BINAER"; exit 1; }\nexit 0' }); +check('S16 den kvitterede lagt ind fra et gammelt arkiv: run-all.sh-vagten kalder den ikke aeldre end kilden, og npm pakker den', s16.rc === 0 && s16.publishSha === FP_H && !/GAMMEL BINAER/.test(s16.ud), + `rc=${s16.rc} · pakket ${s16.publishSha.slice(0, 8)} · ${stopLinje(s16)}`); + console.log(fails.length ? `DUMPET: ${fails.length} tjek` : 'Alle tjek bestået.'); process.exit(fails.length ? 1 : 0); From ace5818bd1fb392900740aac7fea4e2ba21c2786 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Fri, 6 Nov 2026 19:11:26 +0100 Subject: [PATCH 86/94] Send gate: who and what must be visible MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Opus R20 (measured): a recipient or a message that is only U+200E counted as read from the screen, so the person approved something blank. Now each needs a visible character (not only spaces, control or format marks); «👍» is still a message and is asked about. Tests u2 in sende-port, red under each old line. CHANGELOG names the known limits for 0.4.2 (press asks nothing about a nameless or icon-only button; its question shows the search, not the element) and that the GitHub asset and .mcpb are built by CI. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 7 ++++++- mcp-server/index.js | 8 ++++++-- test/sende-port.mjs | 13 +++++++++++++ 3 files changed, 25 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 115baa49..a97c61c4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -160,7 +160,12 @@ letter or a digit: a space, a line break or an invisible mark (`aria-label=" "`, switch off the «we don't know what this is» rule (13z5-13z8). Known cost: the text of a link whose name looks dangerous («Slut med …», «Delete …») now asks like a click on the link itself, in a web chat or webmail the text of a link with a send word, far from the text field, is refused like an untied Send, and a named element inside a -button that has no name (common in Electron and web apps) is now asked about too. Opera GX, Comet and Dia (Chromium), Orion and +button that has no name (common in Electron and web apps) is now asked about too. In the send gate, who a message goes to +and what it says must contain something visible: a recipient or a message that is only an invisible mark (U+200E) counts as +unreadable, so nothing is sent, while «👍» is still asked about. Known limits, for 0.4.2: `computer_press` does not ask about +a nameless or icon-only button the way a click does, and its question shows what the agent searched for, not the element's +own name. The npm package carries the helper that the live Chrome tests proved; the binary attached to the GitHub release and +the .mcpb bundle are built by CI from the tag. Opera GX, Comet and Dia (Chromium), Orion and DuckDuckGo (WebKit) and Zen (Gecko) are browsers for both the helper's password-page gate and the send gate - their ids read from Homebrew's cask data, not measured on an installed copy. A search that stopped early now also names the password manager pages it skipped (as not-found already did), and a blur answer says how many windows it reached (`windows_scanned`). The diff --git a/mcp-server/index.js b/mcp-server/index.js index fa8ed607..f8d54429 100644 --- a/mcp-server/index.js +++ b/mcp-server/index.js @@ -704,6 +704,10 @@ const klikPunkt = (name, args) => name === 'computer_drag' ? [args.fromX, args.f // fare-porten, saa «vi ved ikke hvad det er» blev slaaet fra af ét mellemrum. Et navn er kun et navn med bogstaver eller cifre; // fareordene er ord, saa intet navn uden bogstaver kunne alligevel goere noget farligt - reglen goer kun dommen strengere. const harNavn = (x) => /[\p{L}\p{N}]/u.test(String(x ?? '')); +// Opus R20 (MAALT): i SEND-porten skal modtager og tekst kunne SES - en modtager eller en besked der kun er U+200E talte som +// «laest fra skaermen», og mennesket sagde ja til noget blankt. Synlig = ikke kun mellemrum, styre- eller formattegn; +// «👍» er en synlig besked uden bogstaver og spoerges om som foer. +const synlig = (x) => /[^\p{Z}\p{C}]/u.test(String(x ?? '')); // Hvordan et element under et klik naevnes for mennesket: titel, ellers beskrivelse, ellers rollen. function knapNavn(e) { const k = forfader(e); @@ -829,13 +833,13 @@ async function sendeDom(name, args, bid, appKlik = null, forhaand = null) { if (!sender) return null; const sam = await laes(); // 1/10: en modtager laest fra samtalens top (og set i chatlisten) vinder over overskrifter. - const hvem = [...(sam.recipient ? [sam.recipient] : (sam.headings || []))].map(x => String(x || '').trim()).filter(Boolean); + const hvem = [...(sam.recipient ? [sam.recipient] : (sam.headings || []))].map(x => String(x || '').trim()).filter(synlig); const felt = sam.field || {}; // ⛔ Runde 2 (Astra 3): et soegefelt er ikke en besked, og uden kolonnen (feltets // ramme) er navnene ikke bundet til feltet. Og Send-knappen skal ligge i det // vindue hvis samtale mennesket faar vist. const erBeskedfelt = /^AX(TextArea|TextField)$/.test(String(felt.role || '')) && felt.subrole !== 'AXSearchField'; - const tekst = felt.secure || !erBeskedfelt ? null : (typeof felt.value === 'string' && felt.value.trim() ? felt.value : null); + const tekst = felt.secure || !erBeskedfelt ? null : (typeof felt.value === 'string' && synlig(felt.value) ? felt.value : null); // ⛔ Runde 3 (Astra 2): vinduet SKAL kunne laeses, og Send-kontrollen skal ligge // paa beskedfeltets raekke - saadan ligger den i chat-apps. Ellers kan knappen // hoere til et andet felt end det hvis tekst mennesket godkendte. diff --git a/test/sende-port.mjs b/test/sende-port.mjs index 26742c56..c02a1d79 100644 --- a/test/sende-port.mjs +++ b/test/sende-port.mjs @@ -149,6 +149,19 @@ try { check(`u ulaeselig ${navn}: afvist, ikke spurgt, intet sendt`, r.fejl && /could not be read/.test(r.tekst) && spurgt.length === foer && handlinger().filter(x => x === 'key').length === k0, r.tekst.slice(0, 100)); } + // R20 (Opus, MAALT): en modtager eller en tekst der kun er et usynligt tegn (U+200E), talte som laest - mennesket sagde ja i blinde. + for (const [navn, sam] of [['usynlig modtager (U+200E)', { ...SAMTALE, headings: ['\u200E'] }], + ['usynlig tekst (U+200E)', { ...SAMTALE, field: { ...SAMTALE.field, value: '\u200E' } }]]) { + foer = spurgt.length; svar({ samtale: sam }); + const k0 = handlinger().filter(x => x === 'key').length; + const r = await kald('computer_key', { app: 'WhatsApp', combo: 'return' }); + check(`u2 ${navn}: afvist, ikke spurgt, intet sendt`, r.fejl && /could not be read/.test(r.tekst) && spurgt.length === foer + && handlinger().filter(x => x === 'key').length === k0, r.tekst.slice(0, 100)); + } + // ...men en synlig besked uden bogstaver er en besked: «👍» spoerges om, den afvises ikke som ulaeselig. + foer = spurgt.length; svar({ samtale: { ...SAMTALE, field: { ...SAMTALE.field, value: '👍' } } }); + const tu = await kald('computer_key', { app: 'WhatsApp', combo: 'return' }); + check('u2 en besked uden bogstaver («👍») spoerges om, afvises ikke', !/could not be read/.test(tu.tekst) && spurgt.length === foer + 1, tu.tekst.slice(0, 100)); svar(); // R6 (runde 1, Astra 1 + Fable F3): «Afsend», en navnloes ikon-knap og mellemrum paa en knap sender ogsaa. From e5a25fe30fd3f7e53effb38065c9b7fb1ce0c6d6 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Fri, 6 Nov 2026 19:11:26 +0100 Subject: [PATCH 87/94] test 15b: the comment says what the zero point now does Co-Authored-By: Claude Opus 5.5 --- test/skaerm-laan.mjs | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/test/skaerm-laan.mjs b/test/skaerm-laan.mjs index f24a4222..8bf8328a 100644 --- a/test/skaerm-laan.mjs +++ b/test/skaerm-laan.mjs @@ -774,7 +774,8 @@ for (const [navn, linjer, stop] of [['16h forkert nonce paa «taken-back», saa X.srv.kill('SIGTERM'); // R18 (Opus, MAALT 8 af 30 roede under belastning): serveren kan laese de nye kald, FOER signalet er haandteret. Vent til et // skrivende kald AFVISES med «shutting down» (flaget er sat) - kun mens serveren lever, og hoejst 500 ms pr. svar, saa en - // server der aldrig saetter flaget giver roedt, ikke et haeng. Et kald foer flaget maa gerne naa frem; reglen gaelder EFTER. + // server der aldrig saetter flaget giver roedt, ikke et haeng. R19: nulpunktet er taget FOER signalet, saa ogsaa et skrivende + // kald, der naaede frem i ventevinduet, taeller som et brud (det dræber mutanten «flaget 300 ms for sent»). const serverLever = () => X.srv.exitCode === null && X.srv.signalCode === null; let flag = null; for (let i = 0; i < 8 && serverLever() && !/shutting down/.test(flag?.tekst || ''); i++) { From 5a1b835e22589755482de3841b4ed6bd810a406d Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Fri, 6 Nov 2026 21:03:57 +0100 Subject: [PATCH 88/94] Package: only the two proven artifacts from vendor/, and every other file must be HEAD's Opus R21 (measured in the real release tree): vendor/ held two old helper backups, and npm packs the folder, so they would have shipped under the proven tag with every lock green; git status cannot see gitignored files. files now lists vendor/cmcp-helper and vendor/ComputerMCPStatus.app (19 entries, a stray stays out). After npm pack, every file in the tarball must equal HEAD's - the files step 0 itself changed (sync-tal) as they stand in the tree - which also stops an ignored file in bin/ and an assume-unchanged edit. Calibrated both ways on a clean simulated release. Matrix S17-S20: icon without x-bit, ignored key file, assume-unchanged index.js, stray in vendor/. Co-Authored-By: Claude Opus 5.5 --- mcp-server/package.json | 3 ++- scripts/release.sh | 17 +++++++++++++++++ test/release-fejlmatrix.mjs | 17 +++++++++++++++-- 3 files changed, 34 insertions(+), 3 deletions(-) diff --git a/mcp-server/package.json b/mcp-server/package.json index 7379713f..279db24a 100644 --- a/mcp-server/package.json +++ b/mcp-server/package.json @@ -22,7 +22,8 @@ "vagt.js", "tilstede.js", "bin/", - "vendor/", + "vendor/cmcp-helper", + "vendor/ComputerMCPStatus.app", "README.md" ], "scripts": { diff --git a/scripts/release.sh b/scripts/release.sh index 1604644a..b4365136 100755 --- a/scripts/release.sh +++ b/scripts/release.sh @@ -81,6 +81,7 @@ python3 "$ROOT/scripts/sync-tal.py" | sed 's/^/ /' # efter sync-tal er nu et oejebliksbillede, som `fastholdt` kraever uaendret foer maerket og foer npm. traetilstand() { { git status --porcelain; git diff HEAD --binary; } | shasum | cut -d' ' -f1; } RENT0=$(traetilstand) +SYNC0=$(git status --porcelain | awk '{print $2}') # de filer trin 0 selv aendrede (R21: pakken maales mod HEAD, disse mod traeet) echo "== 1/7 byg den binaer vi faktisk udsender ==" # ⛔ Y3a. `mcp-server/vendor/` er gitignored: binaeren er IKKE i et commit, den @@ -371,6 +372,22 @@ PH="$PAKKE/package/vendor/cmcp-helper"; PI="$PAKKE/package/vendor/ComputerMCPSta && [ -x "$PI/Contents/MacOS/cmcp-status" ] && [ "$(traesum "$PI")" = "$FORVENTET_IKON" ] \ || { echo "⛔ pakken npm ville udsende ($TGZ) har ikke den kvitterede hjaelper og det kvitterede ikon (med x-bit) - udgiver ikke"; exit 1; } echo " pakken er maalt: hjaelperen og ikonet i den er de kvitterede" +# ⛔ Opus R21 (MAALT i det RIGTIGE udgivelsestrae): `git status` er ikke traeet. To gamle hjaelper-backups i den gitignorerede +# vendor/, en ignoreret fil i bin/ (fx *.key fra den globale gitignore) og en `assume-unchanged`-aendring kom alle ud med +# alle laase groenne. Hver fil i pakken skal derfor vaere HEAD's - de filer trin 0 selv aendrede (sync-tal), som de staar i +# traeet - og i vendor/ kun de to kvitterede, der er maalt ovenfor. +FREMMED="" +while IFS= read -r -d '' f; do + rel=${f#"$PAKKE/package/"} + case "$rel" in vendor/cmcp-helper|vendor/ComputerMCPStatus.app/*) continue ;; esac + if printf '%s\n' $SYNC0 | grep -qxF "mcp-server/$rel"; then + cmp -s "$f" "mcp-server/$rel" || FREMMED="$FREMMED $rel" + elif ! git cat-file -e "HEAD:mcp-server/$rel" 2>/dev/null || [ "$(git show "HEAD:mcp-server/$rel" | shasum)" != "$(shasum < "$f")" ]; then + FREMMED="$FREMMED $rel" + fi +done < <(find "$PAKKE/package" -type f -print0) +[ -z "$FREMMED" ] || { echo "⛔ pakken baerer filer, der hverken er HEAD's eller de kvitterede:$FREMMED - udgiver ikke"; exit 1; } +echo " pakken er maalt: hver anden fil er HEAD's" ( cd mcp-server && npm publish "$TGZ" --access public ) # ⛔ 7/10 (panel R2+R8, E): faelden stod armeret gennem deprecate. Et afbrudt deprecate # (Ctrl-C mens browseren venter) rullede PUBLICERET tilbage og skrev «udgivelsen diff --git a/test/release-fejlmatrix.mjs b/test/release-fejlmatrix.mjs index 415207f2..7fb5f260 100644 --- a/test/release-fejlmatrix.mjs +++ b/test/release-fejlmatrix.mjs @@ -46,6 +46,7 @@ function scenarie(navn, { gh = {}, npm = {}, git = {}, env = {}, foer = null, ru execFileSync(GIT, ['clone', '-q', '--no-hardlinks', ROOT, K]); // Proeven skal maale release.sh som det staar i arbejdstraeet, ogsaa foer commit. cpSync(join(ROOT, 'scripts', 'release.sh'), join(K, 'scripts', 'release.sh')); + cpSync(join(ROOT, 'mcp-server', 'package.json'), join(K, 'mcp-server', 'package.json')); // R21: pakkens filliste ogsaa writeFileSync(join(K, 'scripts', 'build-release.sh'), '#!/bin/sh\nexit 0\n'); writeFileSync(join(K, 'test', 'run-all.sh'), `#!/bin/sh\n${runAll}\n`); chmodSync(join(K, 'scripts', 'build-release.sh'), 0o755); chmodSync(join(K, 'test', 'run-all.sh'), 0o755); @@ -71,7 +72,7 @@ function scenarie(navn, { gh = {}, npm = {}, git = {}, env = {}, foer = null, ru esac`); stub('npm', `case "$1" in whoami) echo proever ;; - publish) if [ -f "$2" ]; then tar -xzOf "$2" package/vendor/cmcp-helper | shasum | cut -c1-40; else shasum vendor/cmcp-helper | cut -c1-40; fi > ${join(D, 'publish-sha')}; ${npm.publish ?? 'exit 0'} ;; + publish) if [ -f "$2" ]; then tar -tzf "$2" > ${join(D, 'publish-liste')}; tar -xzOf "$2" package/vendor/cmcp-helper | shasum | cut -c1-40; else shasum vendor/cmcp-helper | cut -c1-40; fi > ${join(D, 'publish-sha')}; ${npm.publish ?? 'exit 0'} ;; deprecate) ${npm.deprecate ?? 'exit 0'} ;; *) exec ${NPM} "$@" ;; # R20: den rigtige npm (fx \`npm pack\`); \`env -u PATH npm\` fandt den aldrig (rc 127) esac`); @@ -86,7 +87,8 @@ esac`); const kald = existsSync(LOG) ? readFileSync(LOG, 'utf8') : ''; const fjernTag = spawnSync(GIT, ['ls-remote', '--tags', BARE, `refs/tags/v${V}`], { encoding: 'utf8' }).stdout.trim(); const publishSha = existsSync(join(D, 'publish-sha')) ? readFileSync(join(D, 'publish-sha'), 'utf8').trim() : ''; - return { rc: r.status, ud: (r.stdout || '') + (r.stderr || ''), kald, fjernTag, publishSha, publiceret: readFileSync(join(K, 'PUBLICERET'), 'utf8').trim() }; + const publishListe = existsSync(join(D, 'publish-liste')) ? readFileSync(join(D, 'publish-liste'), 'utf8') : ''; + return { rc: r.status, ud: (r.stdout || '') + (r.stderr || ''), kald, fjernTag, publishSha, publishListe, publiceret: readFileSync(join(K, 'PUBLICERET'), 'utf8').trim() }; } // S1: GitHub svarer ikke paa CI-forespoergslen -> UKENDT, intet maerket. @@ -156,5 +158,16 @@ const s16 = scenarie('arkiv-tidsstempel', { foer: anden, env: { HJAELPER_FIL: GA check('S16 den kvitterede lagt ind fra et gammelt arkiv: run-all.sh-vagten kalder den ikke aeldre end kilden, og npm pakker den', s16.rc === 0 && s16.publishSha === FP_H && !/GAMMEL BINAER/.test(s16.ud), `rc=${s16.rc} · pakket ${s16.publishSha.slice(0, 8)} · ${stopLinje(s16)}`); +// S17-S20 (Opus R21, MAALT i det rigtige udgivelsestrae): `git status` er ikke traeet, og npm pakker en MAPPE. +const s17 = scenarie('ikon-uden-x', { runAll: 'chmod -x mcp-server/vendor/ComputerMCPStatus.app/Contents/MacOS/cmcp-status\nexit 0' }); +check('S17 ikonets binaer uden x-bit (traesummen ser ikke rettigheder): pakken maales og stopper, intet npm', s17.rc !== 0 && /pakken npm ville udsende/.test(s17.ud) && !/npm publish/.test(s17.kald), stopLinje(s17)); +const s18 = scenarie('ignoreret-fil', { runAll: "echo hemmeligt > mcp-server/bin/proeve.key && echo 'mcp-server/bin/proeve.key' >> .git/info/exclude\nexit 0" }); +check('S18 en ignoreret fil i bin/ (usynlig for git status): pakken stopper og navngiver den, intet npm', s18.rc !== 0 && /hverken er HEAD's.*bin\/proeve\.key/.test(s18.ud) && !/npm publish/.test(s18.kald), stopLinje(s18)); +const s19 = scenarie('assume-unchanged', { runAll: "git update-index --assume-unchanged mcp-server/index.js && printf '// skjult\\n' >> mcp-server/index.js\nexit 0" }); +check('S19 index.js aendret og skjult med assume-unchanged: pakken stopper (index.js), intet npm', s19.rc !== 0 && /hverken er HEAD's.*index\.js/.test(s19.ud) && !/npm publish/.test(s19.kald), stopLinje(s19)); +const s20 = scenarie('stray-i-vendor', { runAll: 'cp -p mcp-server/vendor/cmcp-helper mcp-server/vendor/cmcp-helper.foer-chrome-proeve\nexit 0' }); +check('S20 en gammel hjaelper-backup i vendor/ (som i det rigtige trae 6/11): kommer IKKE med, og udgivelsen lykkes', s20.rc === 0 && !!s20.publishListe && !/foer-chrome/.test(s20.publishListe) && s20.publishSha === FP_H, + `rc=${s20.rc} · ${(s20.publishListe.match(/vendor\/[^\n]*/g) || []).length} vendor-poster · ${stopLinje(s20)}`); + console.log(fails.length ? `DUMPET: ${fails.length} tjek` : 'Alle tjek bestået.'); process.exit(fails.length ? 1 : 0); From 0c7ecdb589ef228d00016ba3b6a519e597feb618 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Fri, 6 Nov 2026 21:03:57 +0100 Subject: [PATCH 89/94] Send gate: blank marks are blank, and a blank browser title asks MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Opus R21 (measured): Hangul fillers, the braille blank, variation selectors and lone accents still counted as visible, and a browser window titled only U+200E skipped the send gate entirely. synlig now treats them as blank (never milder than before; «👍», «🇩🇰» and «é» stay visible), harNavn ignores default-ignorable «letters», and browser titles are cleaned of invisible marks before they are judged. Tests u2, r6b and 13z9, each red under its old line. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 11 ++++++----- mcp-server/index.js | 15 ++++++++++----- test/bundet-maal.mjs | 2 ++ test/sende-port.mjs | 12 +++++++++++- 4 files changed, 29 insertions(+), 11 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index a97c61c4..f5589870 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -156,13 +156,14 @@ the last). Clicking the TEXT inside a button (B7) is judged as the button: the h time and names it (13z2); an older helper without the field behaves as before. The ancestor can only make a verdict stricter, never milder: a nameless icon inside a button called «Open» is still asked about, as it was before (13z3), and a name the page puts on several lines is shown on one line in the question (13z4). A name is only a name when it has a -letter or a digit: a space, a line break or an invisible mark (`aria-label=" "`, U+200E) no longer counts, so it cannot -switch off the «we don't know what this is» rule (13z5-13z8). Known cost: the text of a link whose name +visible letter or digit: a space, a line break or an invisible mark (`aria-label=" "`, U+200E, a Hangul filler) no longer counts, so it cannot +switch off the «we don't know what this is» rule (13z5-13z9). Known cost: the text of a link whose name looks dangerous («Slut med …», «Delete …») now asks like a click on the link itself, in a web chat or webmail the text of a link with a send word, far from the text field, is refused like an untied Send, and a named element inside a -button that has no name (common in Electron and web apps) is now asked about too. In the send gate, who a message goes to -and what it says must contain something visible: a recipient or a message that is only an invisible mark (U+200E) counts as -unreadable, so nothing is sent, while «👍» is still asked about. Known limits, for 0.4.2: `computer_press` does not ask about +button that has no name (common in Electron and web apps) is now asked about too. In the send gate, a recipient or a message +made only of blank or invisible marks (U+200E, Hangul fillers, the braille blank, lone accents and the like) counts as +unreadable, so nothing is sent, while «👍» is still asked about; a browser window whose title is blank or invisible is +treated as a chat, so Return there asks. Known limits, for 0.4.2: `computer_press` does not ask about a nameless or icon-only button the way a click does, and its question shows what the agent searched for, not the element's own name. The npm package carries the helper that the live Chrome tests proved; the binary attached to the GitHub release and the .mcpb bundle are built by CI from the tag. Opera GX, Comet and Dia (Chromium), Orion and diff --git a/mcp-server/index.js b/mcp-server/index.js index f8d54429..0dddf45b 100644 --- a/mcp-server/index.js +++ b/mcp-server/index.js @@ -703,11 +703,16 @@ const klikPunkt = (name, args) => name === 'computer_drag' ? [args.fromX, args.f // Opus R19 B4 (MAALT): et navn af mellemrum, linjeskift eller usynlige tegn (U+200E, aria-label=" ") talte som et NAVN i // fare-porten, saa «vi ved ikke hvad det er» blev slaaet fra af ét mellemrum. Et navn er kun et navn med bogstaver eller cifre; // fareordene er ord, saa intet navn uden bogstaver kunne alligevel goere noget farligt - reglen goer kun dommen strengere. -const harNavn = (x) => /[\p{L}\p{N}]/u.test(String(x ?? '')); +// R21 (Opus, MAALT): Hangul-fyld (U+3164, U+115F, U+FFA0) er «bogstaver» (\p{Lo}), men usynlige - de taeller ikke som navn. +const harNavn = (x) => /(?!\p{Default_Ignorable_Code_Point})[\p{L}\p{N}]/u.test(String(x ?? '')); // Opus R20 (MAALT): i SEND-porten skal modtager og tekst kunne SES - en modtager eller en besked der kun er U+200E talte som // «laest fra skaermen», og mennesket sagde ja til noget blankt. Synlig = ikke kun mellemrum, styre- eller formattegn; // «👍» er en synlig besked uden bogstaver og spoerges om som foer. -const synlig = (x) => /[^\p{Z}\p{C}]/u.test(String(x ?? '')); +// R21 (Opus, MAALT over alle 1.114.112 kodepunkter): ogsaa Hangul-fyld, braille-blank (U+2800), variantvaelgere og loese +// accenter er blanke. Reglen er aldrig mildere end den forrige og siger stadig ja til «👍», «❤️», «🇩🇰» og «é». +const synlig = (x) => /[^\p{Z}\p{C}\p{M}\p{Default_Ignorable_Code_Point}\u2800]/u.test(String(x ?? '')); +// Et vindues titel uden de usynlige tegn - saa «WhatsApp»+U+200E stadig er WhatsApp, og en blank titel er blank (R21). +const renTitel = (x) => String(x || '').replace(/[\p{Cf}\p{Default_Ignorable_Code_Point}]/gu, '').trim(); // Hvordan et element under et klik naevnes for mennesket: titel, ellers beskrivelse, ellers rollen. function knapNavn(e) { const k = forfader(e); @@ -778,9 +783,9 @@ async function sendeDom(name, args, bid, appKlik = null, forhaand = null) { // R7-R10: et klik i en adgangskode-side naar ikke hertil - det afvises foer sende-dommen (med og uden app). // Runde 5 (Astra 2, Fable 1): en kontrol hvis vindue ikke kan laeses, er et ukendt // vindue - det doemmes som den fokuserede titel doemmes: fejl-lukket, som en chat. - const titler = [String(t.window || '').trim(), ...(k ? [k.fejl ? '' : String(k.vindue || '').trim()] : [])]; - // Kan en titel ikke laeses, ved vi ikke hvad siden er: behandl den som en chat (fejl lukket). - slags = titler.some(x => !x || WEBCHAT.test(x)) ? 'chat' : titler.some(x => WEBMAIL.test(x)) ? 'mail' : null; + const titler = [renTitel(t.window), ...(k ? [k.fejl ? '' : renTitel(k.vindue)] : [])]; + // Kan en titel ikke laeses (eller er den blank/usynlig, R21), ved vi ikke hvad siden er: behandl den som en chat (fejl lukket). + slags = titler.some(x => !synlig(x) || WEBCHAT.test(x)) ? 'chat' : titler.some(x => WEBMAIL.test(x)) ? 'mail' : null; if (!slags) return null; } // I en chat er et linjeskift - og ethvert andet styretegn end tab - en usynlig afsendelse. diff --git a/test/bundet-maal.mjs b/test/bundet-maal.mjs index 0fca8596..b7f33838 100644 --- a/test/bundet-maal.mjs +++ b/test/bundet-maal.mjs @@ -720,6 +720,8 @@ for (const [nr, tekst, args, rolle] of [ ['13z6', 'ikon med et usynligt tegn (U+200E) som titel i en knap «Open»: spoerges', { ...IKON, title: '\u200E' }, (sp) => sp.length >= 1], ['13z7', 'ikon med et linjeskift som titel i en knap «Open»: spoerges', { ...IKON, title: '\n' }, (sp) => sp.length >= 1], ['13z8', 'navnloes tekst i en knap hvis navn er ét mellemrum: spoerges', { ...IKON, role: 'AXStaticText', control: { role: 'AXButton', title: ' ', description: '' } }, (sp) => sp.length >= 1], + // R21 (Opus, MAALT): Hangul-fyld er et «bogstav» (\p{Lo}), men usynligt - det taeller ikke som navn. + ['13z9', 'ikon med Hangul-fyld (U+3164) som titel i en knap «Open»: spoerges', { ...IKON, title: '\u3164' }, (sp) => sp.length >= 1], ]) { const sp = lavFalskSpoerger('ja', 'cmcp-bundet-o1'); const { srv, rpc, kald } = klient({ apps: APPSF, at: el }, { CMCP_BACKGROUND: '0', CMCP_OSASCRIPT: sp.sti }); diff --git a/test/sende-port.mjs b/test/sende-port.mjs index c02a1d79..339981c0 100644 --- a/test/sende-port.mjs +++ b/test/sende-port.mjs @@ -150,8 +150,11 @@ try { && handlinger().filter(x => x === 'key').length === k0, r.tekst.slice(0, 100)); } // R20 (Opus, MAALT): en modtager eller en tekst der kun er et usynligt tegn (U+200E), talte som laest - mennesket sagde ja i blinde. + // R21 (Opus, MAALT): ogsaa Hangul-fyld (U+3164) og braille-blank (U+2800) er blanke. for (const [navn, sam] of [['usynlig modtager (U+200E)', { ...SAMTALE, headings: ['\u200E'] }], - ['usynlig tekst (U+200E)', { ...SAMTALE, field: { ...SAMTALE.field, value: '\u200E' } }]]) { + ['usynlig tekst (U+200E)', { ...SAMTALE, field: { ...SAMTALE.field, value: '\u200E' } }], + ['blank modtager (U+3164)', { ...SAMTALE, headings: ['\u3164'] }], + ['blank tekst (U+2800)', { ...SAMTALE, field: { ...SAMTALE.field, value: '\u2800' } }]]) { foer = spurgt.length; svar({ samtale: sam }); const k0 = handlinger().filter(x => x === 'key').length; const r = await kald('computer_key', { app: 'WhatsApp', combo: 'return' }); @@ -189,6 +192,13 @@ try { foer = spurgt.length; svar({ samtale: { ...SAMTALE, window: 'WhatsApp - Google Chrome' } }); await kald('computer_key', { app: 'Google Chrome', combo: 'return' }); check('r6 Return i WhatsApp Web i en browser spoerger', spurgt.length === foer + 1, `${spurgt.length - foer}`); + // R21 (Opus, MAALT: spurgt 0, Return udfoert): en blank eller usynlig vinduestitel er en ULAESELIG titel - fejl lukket, som en + // tom; og «WhatsApp» med et usynligt tegn bagved er stadig WhatsApp. + for (const titel of ['\u200E', '\u3164', 'WhatsApp\u200E']) { + foer = spurgt.length; svar({ samtale: { ...SAMTALE, window: titel } }); + await kald('computer_key', { app: 'Google Chrome', combo: 'return' }); + check(`r6b browsertitel ${JSON.stringify(titel)}: Return spoerger`, spurgt.length === foer + 1, `${spurgt.length - foer}`); + } foer = spurgt.length; svar({ samtale: { ...SAMTALE, window: 'Wikipedia - Google Chrome' } }); const k1 = handlinger().filter(x => x === 'key').length; await kald('computer_key', { app: 'Google Chrome', combo: 'return' }); From 1604a6cc20b9cd95748261e16d5c7af1e16e65af Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Fri, 6 Nov 2026 21:03:57 +0100 Subject: [PATCH 90/94] Mutant port: seven anchors point at the merged code again Six broke in the merge (the Chrome track moved the anchored lines), one in 785a174. All 401 anchors are found exactly once; the seven were run through the port: 0 survived, 0 errors. Co-Authored-By: Claude Opus 5.5 --- .github/mutanter-porte.json | 28 ++++++++++++++++------------ 1 file changed, 16 insertions(+), 12 deletions(-) diff --git a/.github/mutanter-porte.json b/.github/mutanter-porte.json index 6013fe25..433c5736 100644 --- a/.github/mutanter-porte.json +++ b/.github/mutanter-porte.json @@ -148,7 +148,7 @@ "fil": "mcp-server/index.js", "par": [ [ - " if (beskedSlags(targetBundleId)) {\n // R27: et klik med `app` genmaales", + " if (beskedSlags(sendeBid)) {\n // R27: et klik med `app` genmaales", " if (sende?.describe) {\n // R27: et klik med `app` genmaales" ] ], @@ -244,8 +244,8 @@ "fil": "mcp-server/index.js", "par": [ [ - " if (nr !== laanNr) return;\n saetLaan(0); laanHaandtag = null;", - " if (nr !== laanNr) return;\n laanHaandtag = null;" + " if (tagetTilbage) { tagetTilbageVed = performance.now(); tagetTilbageUsikkert = !slutGrund; }\n saetLaan(0); laanHaandtag = null;", + " if (tagetTilbage) { tagetTilbageVed = performance.now(); tagetTilbageUsikkert = !slutGrund; }\n laanHaandtag = null;" ] ], "proeve": "test/skaerm-laan.mjs", @@ -268,8 +268,12 @@ "fil": "mcp-server/godkend.js", "par": [ [ - " const til = Math.min(vores, Number(m.until) > 0 ? Number(m.until) : vores);", - " const til = vores;" + " const til = Math.min(vores, Number(m.until) > 0 ? Number(m.until) : vores);\n afgoer({ ok: true, til, afslut: () => sock.destroy(), grund: 'the person gave this agent the screen and confirmed it was them", + " const til = vores;\n afgoer({ ok: true, til, afslut: () => sock.destroy(), grund: 'the person gave this agent the screen and confirmed it was them" + ], + [ + " const til = Math.min(vores, Number(m.until) > 0 ? Number(m.until) : vores);\n afgoer({ ok: true, til, afslut: () => sock.destroy(), grund: 'the person has set this Mac to lend the screen without asking (CMCP_SCREEN_ASK=0)", + " const til = vores;\n afgoer({ ok: true, til, afslut: () => sock.destroy(), grund: 'the person has set this Mac to lend the screen without asking (CMCP_SCREEN_ASK=0)" ] ], "proeve": "test/skaerm-laan.mjs", @@ -906,8 +910,8 @@ "forventet": "computer_press i readonly", "par": [ [ - " const sende = (effektivTier === TIER.READ || kunLaes) ? null : await sendeDom(name, args, targetBundleId, appKlik);", - " const sende = effektivTier === TIER.READ ? null : await sendeDom(name, args, targetBundleId, appKlik);" + " const sende = (effektivTier === TIER.READ || kunLaes) ? null : await sendeDom(name, args, sendeBid, appKlik, koordinatOpslag);", + " const sende = effektivTier === TIER.READ ? null : await sendeDom(name, args, sendeBid, appKlik, koordinatOpslag);" ] ] }, @@ -1026,8 +1030,8 @@ "forventet": "S3 publish lykkedes", "par": [ [ - "( cd mcp-server && npm publish --access public )\n# ⛔ 7/10 (panel R2+R8, E): faelden stod armeret gennem deprecate.", - "( cd mcp-server && npm publish --access public )\n# (mutant: ingen afvaebning her)" + "( cd mcp-server && npm publish \"$TGZ\" --access public )\n# ⛔ 7/10 (panel R2+R8, E): faelden stod armeret gennem deprecate.", + "( cd mcp-server && npm publish \"$TGZ\" --access public )\n# (mutant: ingen afvaebning her)" ], [ "trap - EXIT\n# ⛔ 25/9 (fyld-tjek)", @@ -2756,8 +2760,8 @@ "fil": "mcp-server/index.js", "par": [ [ - " const d = appKlik || await callHelper(['at', '--x', String(args.x), '--y', String(args.y)], { timeout: 8000 });\n if (!d?.found) return true;", - " const d = await callHelper(['at', '--x', String(args.x), '--y', String(args.y)], { timeout: 8000 });\n if (!d?.found) return true;" + " const d = appKlik || forhaand || await callHelper(['at', '--x', String(kx), '--y', String(ky)], { timeout: 8000 });\n if (!d?.found) return true;", + " const d = await callHelper(['at', '--x', String(kx), '--y', String(ky)], { timeout: 8000 });\n if (!d?.found) return true;" ] ], "proeve": "test/bundet-maal.mjs", @@ -3960,7 +3964,7 @@ "fil": "helper/Sources/cmcp-status/main.swift", "par": [ [ - "catch { NSSound.beep(); noterKilde(\"stop-all-write-failed\") }\n aktivtLaan?.afslutLaan()", + "catch { NSSound.beep(); noterKilde(\"stop-all-write-failed\") }\n aktivtLaan?.afslutLaan(grund: \"stopped-all\")", "catch { NSSound.beep(); noterKilde(\"stop-all-write-failed\") }" ] ], From a9dabc3cf1fcb585a98b2b5c368ec2800fb1ef22 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Fri, 6 Nov 2026 22:35:00 +0100 Subject: [PATCH 91/94] Send gate: an invisible mark in a browser title becomes a space, not nothing MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Opus R22 (measured through the real server): deleting the marks removed the word boundary, so a Send press in Chrome titled «Gmail»+U+FEFF+«Inbox» or «WhatsApp»+U+FEFF+«Web» went through without asking (asked before 0c7ecdb). A space keeps the boundary: 0 milder of 54,491,136 measured titles. Tests r6b (U+FEFF between words, braille blank title) and u2 (a lone accent), each red under its old line (deletion, no \p{M}, !x instead of !synlig). Co-Authored-By: Claude Opus 5.5 --- mcp-server/index.js | 4 +++- test/sende-port.mjs | 6 ++++-- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/mcp-server/index.js b/mcp-server/index.js index 0dddf45b..39ad09bc 100644 --- a/mcp-server/index.js +++ b/mcp-server/index.js @@ -712,7 +712,9 @@ const harNavn = (x) => /(?!\p{Default_Ignorable_Code_Point})[\p{L}\p{N}]/u.test( // accenter er blanke. Reglen er aldrig mildere end den forrige og siger stadig ja til «👍», «❤️», «🇩🇰» og «é». const synlig = (x) => /[^\p{Z}\p{C}\p{M}\p{Default_Ignorable_Code_Point}\u2800]/u.test(String(x ?? '')); // Et vindues titel uden de usynlige tegn - saa «WhatsApp»+U+200E stadig er WhatsApp, og en blank titel er blank (R21). -const renTitel = (x) => String(x || '').replace(/[\p{Cf}\p{Default_Ignorable_Code_Point}]/gu, '').trim(); +// R22 (Opus, MAALT): at SLETTE maerkerne fjernede ordgraensen - «WhatsApp»+U+FEFF+«Web» blev «WhatsAppWeb», og et tryk paa Send gik +// igennem uden spoergsmaal (spurgt 1 foer, 0 efter). Et mellemrum bevarer graensen: 0 mildere af 54.491.136 maalte titler. +const renTitel = (x) => String(x || '').replace(/[\p{Cf}\p{Default_Ignorable_Code_Point}]/gu, ' ').trim(); // Hvordan et element under et klik naevnes for mennesket: titel, ellers beskrivelse, ellers rollen. function knapNavn(e) { const k = forfader(e); diff --git a/test/sende-port.mjs b/test/sende-port.mjs index 339981c0..897f35ba 100644 --- a/test/sende-port.mjs +++ b/test/sende-port.mjs @@ -154,7 +154,8 @@ try { for (const [navn, sam] of [['usynlig modtager (U+200E)', { ...SAMTALE, headings: ['\u200E'] }], ['usynlig tekst (U+200E)', { ...SAMTALE, field: { ...SAMTALE.field, value: '\u200E' } }], ['blank modtager (U+3164)', { ...SAMTALE, headings: ['\u3164'] }], - ['blank tekst (U+2800)', { ...SAMTALE, field: { ...SAMTALE.field, value: '\u2800' } }]]) { + ['blank tekst (U+2800)', { ...SAMTALE, field: { ...SAMTALE.field, value: '\u2800' } }], + ['loes accent (U+0301)', { ...SAMTALE, field: { ...SAMTALE.field, value: '\u0301' } }]]) { foer = spurgt.length; svar({ samtale: sam }); const k0 = handlinger().filter(x => x === 'key').length; const r = await kald('computer_key', { app: 'WhatsApp', combo: 'return' }); @@ -194,7 +195,8 @@ try { check('r6 Return i WhatsApp Web i en browser spoerger', spurgt.length === foer + 1, `${spurgt.length - foer}`); // R21 (Opus, MAALT: spurgt 0, Return udfoert): en blank eller usynlig vinduestitel er en ULAESELIG titel - fejl lukket, som en // tom; og «WhatsApp» med et usynligt tegn bagved er stadig WhatsApp. - for (const titel of ['\u200E', '\u3164', 'WhatsApp\u200E']) { + // R22 (Opus, MAALT): U+FEFF mellem to ord maa ikke fjerne ordgraensen; en braille-blank titel er blank. + for (const titel of ['\u200E', '\u3164', 'WhatsApp\u200E', 'WhatsApp\uFEFFWeb', '\u2800']) { foer = spurgt.length; svar({ samtale: { ...SAMTALE, window: titel } }); await kald('computer_key', { app: 'Google Chrome', combo: 'return' }); check(`r6b browsertitel ${JSON.stringify(titel)}: Return spoerger`, spurgt.length === foer + 1, `${spurgt.length - foer}`); From 3f7f7852383a12c6cb5369c399b12f46013900fc Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Fri, 6 Nov 2026 22:35:01 +0100 Subject: [PATCH 92/94] release.sh: read step 0's changed files with -z Opus R22: awk '{print $2}' split a name with a space and kept git's quoting of non-ASCII, so such a file would be measured against HEAD and stop the release (fail-closed, latent: none of today's 15 files has either). Matrix 23/23 unchanged. Co-Authored-By: Claude Opus 5.5 --- scripts/release.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scripts/release.sh b/scripts/release.sh index b4365136..cbda4b65 100755 --- a/scripts/release.sh +++ b/scripts/release.sh @@ -81,7 +81,7 @@ python3 "$ROOT/scripts/sync-tal.py" | sed 's/^/ /' # efter sync-tal er nu et oejebliksbillede, som `fastholdt` kraever uaendret foer maerket og foer npm. traetilstand() { { git status --porcelain; git diff HEAD --binary; } | shasum | cut -d' ' -f1; } RENT0=$(traetilstand) -SYNC0=$(git status --porcelain | awk '{print $2}') # de filer trin 0 selv aendrede (R21: pakken maales mod HEAD, disse mod traeet) +SYNC0=$(git status --porcelain -z | tr '\0' '\n' | cut -c4-) # de filer trin 0 selv aendrede (R21: pakken maales mod HEAD, disse mod traeet) echo "== 1/7 byg den binaer vi faktisk udsender ==" # ⛔ Y3a. `mcp-server/vendor/` er gitignored: binaeren er IKKE i et commit, den @@ -380,7 +380,7 @@ FREMMED="" while IFS= read -r -d '' f; do rel=${f#"$PAKKE/package/"} case "$rel" in vendor/cmcp-helper|vendor/ComputerMCPStatus.app/*) continue ;; esac - if printf '%s\n' $SYNC0 | grep -qxF "mcp-server/$rel"; then + if printf '%s\n' "$SYNC0" | grep -qxF "mcp-server/$rel"; then cmp -s "$f" "mcp-server/$rel" || FREMMED="$FREMMED $rel" elif ! git cat-file -e "HEAD:mcp-server/$rel" 2>/dev/null || [ "$(git show "HEAD:mcp-server/$rel" | shasum)" != "$(shasum < "$f")" ]; then FREMMED="$FREMMED $rel" From e9ca16ac6e17cc69cb4b297841467e95c2e56145 Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Fri, 6 Nov 2026 22:35:01 +0100 Subject: [PATCH 93/94] Mutant port: five title anchors point at the new title lines 0c7ecdb rewrote the two browser-title lines that five mutants anchor on, and 1604a6c's message claimed all anchors were found - measured before that edit. Each anchor now carries the same mutation as on main. All 401 found exactly once (checked in the commit's own command); the five run through the port: 0 survived, 0 errors. Co-Authored-By: Claude Opus 5.5 --- .github/mutanter-porte.json | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/mutanter-porte.json b/.github/mutanter-porte.json index 433c5736..53ec434d 100644 --- a/.github/mutanter-porte.json +++ b/.github/mutanter-porte.json @@ -208,8 +208,8 @@ "fil": "mcp-server/index.js", "par": [ [ - " slags = titler.some(x => !x || WEBCHAT.test(x)) ? 'chat' : titler.some(x => WEBMAIL.test(x)) ? 'mail' : null;", - " slags = titler.some(x => !x) ? 'chat' : null;" + " slags = titler.some(x => !synlig(x) || WEBCHAT.test(x)) ? 'chat' : titler.some(x => WEBMAIL.test(x)) ? 'mail' : null;", + " slags = titler.some(x => !synlig(x)) ? 'chat' : null;" ] ], "proeve": "test/sende-port.mjs", @@ -484,8 +484,8 @@ "fil": "mcp-server/index.js", "par": [ [ - " slags = titler.some(x => !x || WEBCHAT.test(x)) ? 'chat' : titler.some(x => WEBMAIL.test(x)) ? 'mail' : null;", - " slags = titler.some(x => x && WEBCHAT.test(x)) ? 'chat' : titler.some(x => WEBMAIL.test(x)) ? 'mail' : null;" + " slags = titler.some(x => !synlig(x) || WEBCHAT.test(x)) ? 'chat' : titler.some(x => WEBMAIL.test(x)) ? 'mail' : null;", + " slags = titler.some(x => synlig(x) && WEBCHAT.test(x)) ? 'chat' : titler.some(x => WEBMAIL.test(x)) ? 'mail' : null;" ] ], "proeve": "test/sende-port.mjs", @@ -496,8 +496,8 @@ "fil": "mcp-server/index.js", "par": [ [ - " slags = titler.some(x => !x || WEBCHAT.test(x)) ? 'chat' : titler.some(x => WEBMAIL.test(x)) ? 'mail' : null;", - " slags = titler.some(x => WEBMAIL.test(x)) ? 'mail' : titler.some(x => !x || WEBCHAT.test(x)) ? 'chat' : null;" + " slags = titler.some(x => !synlig(x) || WEBCHAT.test(x)) ? 'chat' : titler.some(x => WEBMAIL.test(x)) ? 'mail' : null;", + " slags = titler.some(x => WEBMAIL.test(x)) ? 'mail' : titler.some(x => !synlig(x) || WEBCHAT.test(x)) ? 'chat' : null;" ] ], "proeve": "test/sende-port.mjs", @@ -604,8 +604,8 @@ "fil": "mcp-server/index.js", "par": [ [ - " const titler = [String(t.window || '').trim(), ...(k ? [k.fejl ? '' : String(k.vindue || '').trim()] : [])];", - " const titler = [String(t.window || '').trim()];" + " const titler = [renTitel(t.window), ...(k ? [k.fejl ? '' : renTitel(k.vindue)] : [])];", + " const titler = [renTitel(t.window)];" ] ], "proeve": "test/sende-port.mjs", @@ -644,8 +644,8 @@ "fil": "mcp-server/index.js", "par": [ [ - " const titler = [String(t.window || '').trim(), ...(k ? [k.fejl ? '' : String(k.vindue || '').trim()] : [])];", - " const titler = [String(t.window || '').trim(), ...(k?.fejl ? [''] : k?.vindue ? [String(k.vindue).trim()] : [])];" + " const titler = [renTitel(t.window), ...(k ? [k.fejl ? '' : renTitel(k.vindue)] : [])];", + " const titler = [renTitel(t.window), ...(k?.fejl ? [''] : k?.vindue ? [renTitel(k.vindue)] : [])];" ] ], "proeve": "test/sende-port.mjs", From 27d9fc0ac991016fef9882ad47b62e55889bb0cd Mon Sep 17 00:00:00 2001 From: Gustav Louv Date: Fri, 6 Nov 2026 23:27:58 +0100 Subject: [PATCH 94/94] test ikon-lyd: check 13 allows only the standing screen loan's early return CI on the 0.4.1 PR (run 42304416072): the screen track (2/11) put an early return before tik() for a standing screen loan (kind=screen, ask=false: a loan without a question is not a question, so no sound). Check 13 required tik() as the first line. It now allows that return - with exactly that condition - and nothing else: Astra's R10 mutant (nyAnmodning calls tik) and an unconditional early return both turn check 13 red. Co-Authored-By: Claude Opus 5.5 --- test/ikon-lyd.mjs | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/test/ikon-lyd.mjs b/test/ikon-lyd.mjs index 85b55d6d..9663b89b 100644 --- a/test/ikon-lyd.mjs +++ b/test/ikon-lyd.mjs @@ -58,7 +58,10 @@ FileHandle.standardOutput.write(try! JSONSerialization.data(withJSONObject: ["ly // var bevist, men ikke at et nyt spoergsmaal NAAR lydstedet. Kaeden bindes her led for led. check('13 et nyt spoergsmaal naar lydstedet: socket -> nyAnmodning -> vis(a)', /anmodninger\.append\(a\)\n\s*nyAnmodning\(a\)/.test(main) && /^nyAnmodning = \{ a in ikon\.vis\(a\) \}$/m.test(main) - && /func vis\(_ a: Anmodning\) \{\n\s*tik\(\)\n\s*if lydHukommelse\.skalLyde\(/.test(main)); + // 6/11 (CI paa 0.4.1-PR'en, MAALT): skaerm-sporet (2/11) lagde en tidlig udgang ind for et STAAENDE skaerm-laan + // (kind=screen, ask=false: «et laan uden spoergsmaal er ikke et spoergsmaal - ingen lyd»). Den - og kun den, med + // netop den betingelse - maa staa foer tik(); enhver anden udgang eller betingelse goer kaeden roed. + && /func vis\(_ a: Anmodning\) \{\n(?:\s*\/\/[^\n]*\n)*(?:\s*if a\.s\.kind == "screen" && a\.s\.ask == false \{[^\n]*return \}\n)?\s*tik\(\)\n\s*if lydHukommelse\.skalLyde\(/.test(main)); check('11 menuen har et punkt der slaar lyden til og fra', /"Play a sound when an agent needs you", action: #selector\(skiftLyd\)/.test(main) && /func skiftLyd\(\) \{ UserDefaults\.standard\.set\(!lydSlaaetTil\(\), forKey: "lyd"\) \}/.test(main)); // README'en lover det standarden giver - begge README'er (claims 45 holder dem ens).