Skip to content

Commit 4dbdcb9

Browse files
waleedlatif1waleedlatif1
committed
feat(computer-use): enable computer use by default, governed by a permission-group restriction
Removes the mothership-computer-use feature flag. Each device still opts in under Settings > Desktop > Computer Use; enterprise admins can withhold it with the new Computer Use permission-group restriction (computer_use.use, which also follows Chat).
1 parent 309539e commit 4dbdcb9

31 files changed

Lines changed: 218 additions & 369 deletions

File tree

‎apps/desktop/README.md‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -234,11 +234,10 @@ Cadence: Electron ships a major every ~8 weeks and supports the latest 3 — bud
234234

235235
## Native Mac computer use
236236

237-
Mothership's `computer` tool is available on macOS 14+ when the global runtime flag
238-
`mothership-computer-use` is enabled and the user opts in under **Settings → Desktop → Computer Use**.
239-
The flag defaults off; local/self-hosted deployments use `MSHIP_COMPUTER_USE=true`, while hosted
240-
rollout uses the existing AppConfig feature-flags document. Older desktop builds omit this optional
241-
bridge and continue to work.
237+
Mothership's `computer` tool is available on macOS 14+ once the user opts in under
238+
**Settings → Desktop → Computer Use**. Enterprise organizations can withhold it from a permission
239+
group with the **Computer Use** restriction. Older desktop builds omit this optional bridge and
240+
continue to work.
242241

243242
The user grants Accessibility and Screen Recording through macOS, then approves each app for the
244243
current task or persistently. Persistent app approvals are listed in Settings and can be revoked.

‎apps/docs/content/docs/platform/enterprise/access-control.mdx‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,7 @@ Most platform restrictions refuse the protected operation at the server as well
9595
| Tools | Custom Tools | Prevents agents from calling custom tools. |
9696
| Tools | Skills | Prevents agents from loading skills. |
9797
| Tools | Tool Auto-Approval | Prevents storing an always-allow preference for tool calls. |
98+
| Tools | Computer Use | Prevents Chat from operating apps on a member's Mac, even when the device allows it. |
9899
| Logs | Trace Spans | Withholds per-block spans from log reads and API responses. |
99100
| Logs | Log Export | Prevents CSV execution-log downloads. |
100101
| Logs | Execution Cost | Omits cost and token spend from governed logs and member exports. Organization-admin data drains are not projected this way. |

‎apps/docs/openapi-v2-resources.json‎

Lines changed: 54 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -7431,7 +7431,8 @@
74317431
"disableKnowledgeBaseExport": false,
74327432
"deniedPartialAccessProjectIssues": [],
74337433
"defaultAgentModel": null,
7434-
"deniedAccessRequests": []
7434+
"deniedAccessRequests": [],
7435+
"disableComputerUse": false
74357436
},
74367437
"isDefault": false,
74377438
"membershipMode": "inherit",
@@ -7592,7 +7593,8 @@
75927593
"disableKnowledgeBaseExport": false,
75937594
"deniedPartialAccessProjectIssues": [],
75947595
"defaultAgentModel": null,
7595-
"deniedAccessRequests": []
7596+
"deniedAccessRequests": [],
7597+
"disableComputerUse": false
75967598
},
75977599
"isDefault": false,
75987600
"membershipMode": "inherit",
@@ -7753,7 +7755,8 @@
77537755
"disableKnowledgeBaseExport": false,
77547756
"deniedPartialAccessProjectIssues": [],
77557757
"defaultAgentModel": null,
7756-
"deniedAccessRequests": []
7758+
"deniedAccessRequests": [],
7759+
"disableComputerUse": false
77577760
},
77587761
"isDefault": false,
77597762
"membershipMode": "inherit",
@@ -7922,7 +7925,8 @@
79227925
"disableKnowledgeBaseExport": false,
79237926
"deniedPartialAccessProjectIssues": [],
79247927
"defaultAgentModel": null,
7925-
"deniedAccessRequests": []
7928+
"deniedAccessRequests": [],
7929+
"disableComputerUse": false
79267930
},
79277931
"isDefault": false,
79287932
"membershipMode": "inherit",
@@ -22420,6 +22424,10 @@
2242022424
"maxLength": 1024
2242122425
},
2242222426
"description": "Access requests are unavailable for the listed canonical target keys when access is restricted."
22427+
},
22428+
"disableComputerUse": {
22429+
"type": "boolean",
22430+
"description": "Revoke computer use. Chat cannot operate apps on a member's Mac, even when the device allows it."
2242322431
}
2242422432
},
2242522433
"required": [
@@ -22467,7 +22475,8 @@
2246722475
"disableKnowledgeBaseExport",
2246822476
"deniedPartialAccessProjectIssues",
2246922477
"defaultAgentModel",
22470-
"deniedAccessRequests"
22478+
"deniedAccessRequests",
22479+
"disableComputerUse"
2247122480
],
2247222481
"additionalProperties": false,
2247322482
"description": "Resolved group settings. True disables a boolean capability; null allowlists permit every value and empty allowlists permit none. defaultAgentModel selects the default for new Agent blocks without restricting model selection."
@@ -22600,7 +22609,8 @@
2260022609
"disableKnowledgeBaseExport": false,
2260122610
"deniedPartialAccessProjectIssues": [],
2260222611
"defaultAgentModel": null,
22603-
"deniedAccessRequests": []
22612+
"deniedAccessRequests": [],
22613+
"disableComputerUse": false
2260422614
},
2260522615
"isDefault": false,
2260622616
"membershipMode": "inherit",
@@ -22678,7 +22688,8 @@
2267822688
"disableKnowledgeBaseExport": false,
2267922689
"deniedPartialAccessProjectIssues": [],
2268022690
"defaultAgentModel": null,
22681-
"deniedAccessRequests": []
22691+
"deniedAccessRequests": [],
22692+
"disableComputerUse": false
2268222693
},
2268322694
"isDefault": false,
2268422695
"membershipMode": "inherit",
@@ -22962,6 +22973,10 @@
2296222973
"maxLength": 1024
2296322974
},
2296422975
"description": "Access requests are unavailable for the listed canonical target keys when access is restricted."
22976+
},
22977+
"disableComputerUse": {
22978+
"type": "boolean",
22979+
"description": "Revoke computer use. Chat cannot operate apps on a member's Mac, even when the device allows it."
2296522980
}
2296622981
},
2296722982
"additionalProperties": false,
@@ -23056,7 +23071,8 @@
2305623071
"disableKnowledgeBaseExport": false,
2305723072
"deniedPartialAccessProjectIssues": [],
2305823073
"defaultAgentModel": null,
23059-
"deniedAccessRequests": []
23074+
"deniedAccessRequests": [],
23075+
"disableComputerUse": false
2306023076
},
2306123077
"isDefault": false,
2306223078
"membershipMode": "inherit",
@@ -23132,7 +23148,8 @@
2313223148
"disableKnowledgeBaseExport": false,
2313323149
"deniedPartialAccessProjectIssues": [],
2313423150
"defaultAgentModel": null,
23135-
"deniedAccessRequests": []
23151+
"deniedAccessRequests": [],
23152+
"disableComputerUse": false
2313623153
},
2313723154
"isDefault": false,
2313823155
"membershipMode": "inherit",
@@ -23423,6 +23440,10 @@
2342323440
"maxLength": 1024
2342423441
},
2342523442
"description": "Access requests are unavailable for the listed canonical target keys when access is restricted."
23443+
},
23444+
"disableComputerUse": {
23445+
"type": "boolean",
23446+
"description": "Revoke computer use. Chat cannot operate apps on a member's Mac, even when the device allows it."
2342623447
}
2342723448
},
2342823449
"additionalProperties": false,
@@ -25920,6 +25941,10 @@
2592025941
"maxLength": 1024
2592125942
},
2592225943
"description": "Access requests are unavailable for the listed canonical target keys when access is restricted."
25944+
},
25945+
"disableComputerUse": {
25946+
"type": "boolean",
25947+
"description": "Revoke computer use. Chat cannot operate apps on a member's Mac, even when the device allows it."
2592325948
}
2592425949
},
2592525950
"required": [
@@ -25967,7 +25992,8 @@
2596725992
"disableKnowledgeBaseExport",
2596825993
"deniedPartialAccessProjectIssues",
2596925994
"defaultAgentModel",
25970-
"deniedAccessRequests"
25995+
"deniedAccessRequests",
25996+
"disableComputerUse"
2597125997
],
2597225998
"additionalProperties": false
2597325999
},
@@ -26727,7 +26753,8 @@
2672726753
"disableToolAutoApproval",
2672826754
"hideSandboxesTab",
2672926755
"disableOAuthAppAccess",
26730-
"disableKnowledgeBaseExport"
26756+
"disableKnowledgeBaseExport",
26757+
"disableComputerUse"
2673126758
],
2673226759
"description": "Feature restriction key returned by access discovery."
2673326760
}
@@ -27039,7 +27066,8 @@
2703927066
"disableToolAutoApproval",
2704027067
"hideSandboxesTab",
2704127068
"disableOAuthAppAccess",
27042-
"disableKnowledgeBaseExport"
27069+
"disableKnowledgeBaseExport",
27070+
"disableComputerUse"
2704327071
],
2704427072
"description": "Feature restriction key returned by access discovery."
2704527073
}
@@ -27439,7 +27467,8 @@
2743927467
"disableToolAutoApproval",
2744027468
"hideSandboxesTab",
2744127469
"disableOAuthAppAccess",
27442-
"disableKnowledgeBaseExport"
27470+
"disableKnowledgeBaseExport",
27471+
"disableComputerUse"
2744327472
],
2744427473
"description": "Feature restriction key returned by access discovery."
2744527474
}
@@ -27837,7 +27866,8 @@
2783727866
"disableToolAutoApproval",
2783827867
"hideSandboxesTab",
2783927868
"disableOAuthAppAccess",
27840-
"disableKnowledgeBaseExport"
27869+
"disableKnowledgeBaseExport",
27870+
"disableComputerUse"
2784127871
],
2784227872
"description": "Feature restriction key returned by access discovery."
2784327873
}
@@ -28193,7 +28223,8 @@
2819328223
"disableToolAutoApproval",
2819428224
"hideSandboxesTab",
2819528225
"disableOAuthAppAccess",
28196-
"disableKnowledgeBaseExport"
28226+
"disableKnowledgeBaseExport",
28227+
"disableComputerUse"
2819728228
],
2819828229
"description": "Feature restriction key returned by access discovery."
2819928230
}
@@ -28452,7 +28483,7 @@
2845228483
"description": "Access request being reviewed."
2845328484
},
2845428485
"changes": {
28455-
"maxItems": 43,
28486+
"maxItems": 44,
2845628487
"type": "array",
2845728488
"items": {
2845828489
"type": "object",
@@ -28502,7 +28533,8 @@
2850228533
"hideSandboxesTab",
2850328534
"disableOAuthAppAccess",
2850428535
"disableKnowledgeBaseExport",
28505-
"deniedPartialAccessProjectIssues"
28536+
"deniedPartialAccessProjectIssues",
28537+
"disableComputerUse"
2850628538
],
2850728539
"description": "Permission restriction changed by approval."
2850828540
},
@@ -28755,7 +28787,8 @@
2875528787
"disableToolAutoApproval",
2875628788
"hideSandboxesTab",
2875728789
"disableOAuthAppAccess",
28758-
"disableKnowledgeBaseExport"
28790+
"disableKnowledgeBaseExport",
28791+
"disableComputerUse"
2875928792
],
2876028793
"description": "Feature restriction key returned by access discovery."
2876128794
}
@@ -29014,7 +29047,7 @@
2901429047
"description": "Access request being reviewed."
2901529048
},
2901629049
"changes": {
29017-
"maxItems": 43,
29050+
"maxItems": 44,
2901829051
"type": "array",
2901929052
"items": {
2902029053
"type": "object",
@@ -29064,7 +29097,8 @@
2906429097
"hideSandboxesTab",
2906529098
"disableOAuthAppAccess",
2906629099
"disableKnowledgeBaseExport",
29067-
"deniedPartialAccessProjectIssues"
29100+
"deniedPartialAccessProjectIssues",
29101+
"disableComputerUse"
2906829102
],
2906929103
"description": "Permission restriction changed by approval."
2907029104
},

‎apps/sim/app/api/desktop/computer/availability/route.ts‎

Lines changed: 0 additions & 21 deletions
This file was deleted.

‎apps/sim/app/extension/providers.tsx‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,6 @@ export function ExtensionProviders({
5555
changelog: false,
5656
'mothership-model-selector': modelSelectorEnabled,
5757
'mothership-plan-mode': planModeEnabled,
58-
'mothership-computer-use': false,
5958
}}
6059
>
6160
<SettingsNavigationProvider navigationTarget='_blank'>

‎apps/sim/app/o/[organizationId]/layout.tsx‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,6 @@ import { getSession } from '@/lib/auth'
77
import { getActiveOrganizationId } from '@/lib/auth/session-response'
88
import { canUseBenchmarks } from '@/lib/benchmarks/config'
99
import { isChangelogEnabled } from '@/lib/changelog/feature-flag'
10-
import { isComputerUseAvailable } from '@/lib/computer-use/availability.server'
1110
import { isDashboardsEnabled } from '@/lib/dashboards/feature-flag'
1211
import { isMothershipModelSelectorEnabled } from '@/lib/mothership/feature-flags'
1312
import { organizationRoutes, WORKSPACE_SETTINGS_PATH } from '@/lib/navigation/paths'
@@ -82,7 +81,6 @@ export default async function OrganizationLayout({
8281
modelSelectorEnabled,
8382
dashboardsEnabled,
8483
benchmarkEnabled,
85-
computerUseEnabled,
8684
workflowTestsEnabled,
8785
changelogEnabled,
8886
projectsEnabled,
@@ -102,7 +100,6 @@ export default async function OrganizationLayout({
102100
logger.warn('Could not resolve benchmark navigation access')
103101
return false
104102
}),
105-
isComputerUseAvailable(organizationId),
106103
isWorkflowTestsEnabled(organizationId),
107104
isChangelogEnabled(organizationId),
108105
isProjectsEnabled(),
@@ -124,7 +121,6 @@ export default async function OrganizationLayout({
124121
'workflow-tests': workflowTestsEnabled,
125122
changelog: changelogEnabled,
126123
'mothership-model-selector': modelSelectorEnabled,
127-
'mothership-computer-use': computerUseEnabled,
128124
'mothership-plan-mode': benchmarkEnabled,
129125
'mothership-memory-spaces': benchmarkEnabled,
130126
projects: projectsEnabled,

‎apps/sim/app/workspace/[workspaceId]/home/components/mothership-chat/rollout-controls.test.tsx‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,6 @@ async function render(advanced: boolean, workspaceId?: string) {
6060
changelog: false,
6161
'mothership-model-selector': advanced,
6262
'mothership-plan-mode': true,
63-
'mothership-computer-use': false,
6463
}}
6564
>
6665
<MothershipChat

‎apps/sim/app/workspace/[workspaceId]/home/hooks/use-chat.ts‎

Lines changed: 1 addition & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -772,7 +772,6 @@ export function useChat(
772772
): UseChatReturn {
773773
const { toast } = useToast()
774774
const modelSelectorEnabled = useFeatureFlag('mothership-model-selector')
775-
const computerUseEnabled = useFeatureFlag('mothership-computer-use')
776775
const workspaceId = typeof owner === 'string' ? owner : undefined
777776
const organizationId = typeof owner === 'string' ? undefined : owner.organizationId
778777
const scopeKey = typeof owner === 'string' ? owner : `organization:${owner.organizationId}`
@@ -4027,16 +4026,7 @@ export function useChat(
40274026
const desktopChatCapabilities =
40284027
options?.requestMode === 'assistant'
40294028
? {}
4030-
: await getDesktopChatCapabilities(
4031-
desktopScopeIdRef.current,
4032-
!computerUseEnabled
4033-
? null
4034-
: organizationId
4035-
? { organizationId }
4036-
: workspaceId
4037-
? { workspaceId }
4038-
: null
4039-
)
4029+
: await getDesktopChatCapabilities(desktopScopeIdRef.current)
40404030

40414031
admissionUnknown = true
40424032
/** A reload from here on may find the server holding this id. */
@@ -4398,7 +4388,6 @@ export function useChat(
43984388
queryClient,
43994389
upsertChatHistory,
44004390
modelSelectorEnabled,
4401-
computerUseEnabled,
44024391
processSSEStream,
44034392
finalize,
44044393
resumeOrFinalize,

0 commit comments

Comments
 (0)