feat(computer-use): enable computer use by default, governed by a permission-group restriction by waleedlatif1 · Pull Request #9944 · simstudioai/sim

waleedlatif1 · 2026-11-12T19:48:40Z

Summary

Computer use is on by default: removes the mothership-computer-use feature flag (registry entry, MSHIP_COMPUTER_USE fallback, layout/provider wiring, client gates)
Each device still opts in under Settings → Desktop → Computer Use (Accessibility, Screen Recording, per-app approval)
New Computer Use permission-group restriction (disableComputerUse → computer_use.use) lets enterprise admins withhold it; the rule also follows Chat (hideCopilot), matching how narrower capabilities subsume their module
desktop.computer.execute declares computer_use.use, so the funnel refuses withheld actions before claiming them; the chat payload only advertises computer use when the owner's group allows it
Removes the /api/desktop/computer/availability route: the client now reports device state only and the server decides, dropping a blocking request from every desktop chat send
Settings hides the device controls when the member's group withholds computer use; the activity chip stays so an in-flight action can still be stopped
Docs: enterprise access-control table, desktop README; regenerated OpenAPI + CLI artifacts

Type of Change

New feature

Testing

bunx vitest run on lib/computer-use, lib/permission-groups, lib/desktop, lib/core/config/feature-flags, settings/desktop, components/computer-use, lib/mothership/chat/payload, ee/access-requests (all green)
New refusal tests (authorize + settings) fail with the gate removed
check:permission-group-enforcement (40 capabilities enforced), check:application-graph, check:api-validation:strict, check:client-boundary, check:openapi, check:cli-api, check:test-patterns, check:comment-hygiene; full gate in CI

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing (new tests pass the test-audit authoring gate)
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

…mission-group restriction Removes the mothership-computer-use feature flag. Each device still opts in under Settings > Desktop > Computer Use; enterprise admins can withhold it with the new Computer Use permission-group restriction (computer_use.use, which also follows Chat).

vercel · 2026-11-12T19:48:44Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Nov 12, 2026 8:27pm UTC

cubic-dev-ai

1 issue found across 31 files

Confidence score: 4/5

In computer-use.tsx, denied members can see the controls while the permission query is loading or fails. Gate them on isPermissionReady as well.

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/sim/app/workspace/[workspaceId]/settings/components/desktop/computer-use.tsx">

<violation number="1" location="apps/sim/app/workspace/[workspaceId]/settings/components/desktop/computer-use.tsx:47">
P2: `usePermissionConfig` falls back to the unrestricted default until its query succeeds, so denied members see these controls during loading and after a failed policy read. Gate on `isPermissionReady` too; server authorization does not prevent the local `setEnabled` and `revokeApp` mutations.</violation>
</file>

_{Turn on auto-fix | Re-trigger cubic}

greptile-apps · 2026-11-12T19:56:54Z

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no new actionable issues were found.

Summary

Enables computer use without a deployment flag while keeping device opt-in and permission-group restrictions.

Mothership computer use now follows device consent instead of a rollout flag.
Enterprise permission groups can withhold computer use from Chat.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  Settings[Open Desktop settings] --> Activity[Keep activity and Stop mounted]
  Settings --> Policy{Permission read succeeded and allows use?}
  Policy -->|Yes| Controls[Mount device controls and read approved apps]
  Policy -->|No| Hidden[Leave device controls unmounted]

_{Reviews (4) · Last reviewed commit: "fix(computer-use): mount the device cont..." · Reviewed by Greptile}

… known Also gives the local-files e2e settings fixture a QueryClient now that the Desktop page reads the permission config.

waleedlatif1 · 2026-11-12T20:02:12Z

@greptile

waleedlatif1 · 2026-11-12T20:02:13Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-11-12T20:02:19Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 32 files

_{Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic}

…ry hook usePermissionConfig pulls the block and provider registries into the Desktop settings bundle; the settings gate only needs the user's resolved config.

waleedlatif1 · 2026-11-12T20:14:46Z

@greptile

waleedlatif1 · 2026-11-12T20:14:47Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-11-12T20:14:54Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 32 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

… group allows them Their effects no longer call the native helper for loading or restricted members.

waleedlatif1 · 2026-11-12T20:27:52Z

@greptile

waleedlatif1 · 2026-11-12T20:27:53Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-11-12T20:28:00Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 32 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

cubic-dev-ai Bot reviewed Nov 12, 2026

View reviewed changes

Comment thread apps/sim/app/workspace/[workspaceId]/settings/components/desktop/computer-use.tsx Resolved

vercel Bot deployed to Preview November 12, 2026 19:53

View deployment

greptile-apps Bot reviewed Nov 12, 2026

View reviewed changes

Comment thread apps/sim/app/workspace/[workspaceId]/settings/components/desktop/computer-use.tsx Resolved

fix(computer-use): hide device settings until the permission group is…

9d1f891

… known Also gives the local-files e2e settings fixture a QueryClient now that the Desktop page reads the permission config.

vercel Bot temporarily deployed to Preview November 12, 2026 20:02 Inactive

cubic-dev-ai Bot reviewed Nov 12, 2026

View reviewed changes

Comment thread apps/sim/app/workspace/[workspaceId]/settings/components/desktop/computer-use.tsx Resolved

fix(computer-use): read the permission group with the lightweight que…

dc5a9df

…ry hook usePermissionConfig pulls the block and provider registries into the Desktop settings bundle; the settings gate only needs the user's resolved config.

vercel Bot temporarily deployed to Preview November 12, 2026 20:14 Inactive

cubic-dev-ai Bot reviewed Nov 12, 2026

View reviewed changes

fix(computer-use): mount the device controls only once the permission…

aca7646

… group allows them Their effects no longer call the native helper for loading or restricted members.

vercel Bot temporarily deployed to Preview November 12, 2026 20:27 Inactive

cubic-dev-ai Bot reviewed Nov 12, 2026

View reviewed changes

waleedlatif1 merged commit 15b2a42 into staging Nov 12, 2026
91 checks passed

waleedlatif1 deleted the feat/computer-use-ga branch November 12, 2026 20:57

Conversation

waleedlatif1 commented Nov 12, 2026

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Nov 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

greptile-apps Bot commented Nov 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Diagram

Uh oh!

Uh oh!

waleedlatif1 commented Nov 12, 2026

Uh oh!

waleedlatif1 commented Nov 12, 2026

Uh oh!

cubic-dev-ai Bot commented Nov 12, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

waleedlatif1 commented Nov 12, 2026

Uh oh!

waleedlatif1 commented Nov 12, 2026

Uh oh!

cubic-dev-ai Bot commented Nov 12, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

waleedlatif1 commented Nov 12, 2026

Uh oh!

waleedlatif1 commented Nov 12, 2026

Uh oh!

cubic-dev-ai Bot commented Nov 12, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented Nov 12, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

greptile-apps Bot commented Nov 12, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading