Maka‘s Computer Use surface was built against other people’s work, in three materially different ways. They are separated here because the obligations differ: one is redistribution under a license, one is reading licensed source, and one is observing a proprietary binary and holds no license grant at all.
Paths are Maka's unless they carry the upstream repository name, as in open-codex-computer-use/....
Every entry names what was taken, where it landed, and what the evidence was. When you add or change a borrowed design, add the row here and put the same statement in the file that carries it — an in-file comment answers “why is this constant 200?” at the moment someone asks it, and this file answers “what did we build on?” for the project as a whole.
Ships inside the Maka artifact. Requires the license text and copyright notice to travel with it.
| Component | License | Where the notice lives |
|---|---|---|
| npm dependencies | various | apps/desktop/resources/licenses/npm/, generated by scripts/generate-third-party-notices.mjs and byte-checked at build by scripts/check-third-party-notices.mjs |
Maka has one Computer Use executor, maka-cu. It is built from Maka's own source by scripts/prepare-maka-cu.mjs and pinned by digest in apps/desktop/bundled-tools.json. It is not signed, so it is not distributed: its distributionReady is false and scripts/verify-macos-arm64-dmg.mjs forbids its path in a packaged build. Nothing third-party ships inside the Maka artifact for Computer Use, which is why the table above has one row.
The third-party executor Maka used to run, cua-driver, was removed along with its vendored notice. Nothing in this tree spawns it or links against it.
maka-cu is itself a fork of MIT-licensed iFurySt/open-codex-computer-use (§2), so when it does ship, that notice travels with it.
MIT-licensed source we read while designing. No code was copied into this repository; what was taken is design — a format, a decision, or an archived measurement. Attribution is given because it was load-bearing, not because MIT compels it for ideas.
Both MIT, © 2026 Leo. An independent reimplementation of Codex's Computer Use as an MCP server.
| Taken | Landed in | Notes |
|---|---|---|
An archived capture of Codex's real get_app_state result | packages/runtime/src/computer-use-tools.ts | Their open-codex-computer-use/artifacts/tool-comparisons/20260417-focus-behavior/. This is what turned Maka‘s model of Codex’s observation format from inference into an observed sample. |
| The one-line-per-element observation shape: indentation for containment, states written only when not the default | same file | Maka‘s version keeps observation_id in the header (frame binding is protocol here, prose there) and keeps element geometry (Codex has no coordinate action surface to need it; Maka’s is disabled by default rather than absent). |
Writing only the informative half of a state — disabled, never enabled | same file | Their summarizeTraits. |
Filtering AXPress out of an element's advertised action list, because pressing is what click does | not yet landed — waits on trycua/cua#2622 exposing per-element AX actions | Their meaningfulActions. |
| The permission-onboarding pattern: anchor a guidance panel to the System Settings window, track it, and distinguish grants that need an app relaunch | not yet landed — for the feat/permission-onboarding work | Their open-codex-computer-use/apps/OpenComputerUse/Sources/OpenComputerUse/PermissionOnboardingApp.swift. |
| Archiving side-by-side tool captures in-repo as evidence | practice, not code | Worth adopting for Maka's own Codex comparisons. |
Not taken, recorded so the decision is not re-litigated: their SkyLightSPI / SkyClickSimulation synthetic-focus click. Their own comment states the recipe is derived from cua-driver and yabai. Maka read the same recipe rather than that code — which is why removing the cua-driver binary from this tree changes nothing here: what was borrowed was a published recipe, not the artifact.
Codex Computer Use (SkyComputerUseService and its helper bundles) is proprietary and ships no source. Nothing was copied from it, because there is nothing to copy: what exists here was reimplemented from observed behaviour and from constants recovered by inspecting the shipped binary.
This confers no rights and is not a license. Statements about it are descriptions of what a build did on a given date, and are dated for that reason.
| Recovered | Landed in |
|---|---|
| The agent cursor: shape, hotspot, motion thresholds, spring constants, and the candidate-path scoring function | apps/desktop/src/renderer/computer-use-overlay/engine/cursor-engine.ts |
| Overlay level policy — an occluded target raises the cursor rather than hiding it | same file, and apps/desktop/src/main/computer-use/cursor-overlay-window.ts |
| The observation text shape | packages/runtime/src/computer-use-tools.ts, corroborated by the archived capture in §2 |
Where Maka deliberately diverges, the divergence is stated at the point of divergence rather than here, so it is read by whoever is changing that code.