docs/computer-use-provenance.md

# Computer Use provenance

Maka's Computer Use surface was built against other people's work, in three
materially different ways. They are separated here because the obligations
differ: one is redistribution under a license, one is reading licensed source,
and one is observing a proprietary binary and holds no license grant at all.

Paths are Maka's unless they carry the upstream repository name, as in
`open-codex-computer-use/...`.

Every entry names what was taken, where it landed, and what the evidence was.
When you add or change a borrowed design, add the row here and put the same
statement in the file that carries it — an in-file comment answers "why is this
constant 200?" at the moment someone asks it, and this file answers "what did we
build on?" for the project as a whole.

## 1. Redistributed under license

Ships inside the Maka artifact. Requires the license text and copyright notice
to travel with it.

| Component | License | Where the notice lives |
|---|---|---|
| npm dependencies | various | `apps/desktop/resources/licenses/npm/`, generated by `scripts/generate-third-party-notices.mjs` and byte-checked at build by `scripts/check-third-party-notices.mjs` |

Maka has one Computer Use executor, `maka-cu`. It is built from Maka's own
source by `scripts/prepare-maka-cu.mjs` and pinned by digest in
`apps/desktop/bundled-tools.json`. It is not signed, so it is not distributed:
its `distributionReady` is false and `scripts/verify-macos-arm64-dmg.mjs`
forbids its path in a packaged build. Nothing third-party ships inside the Maka
artifact for Computer Use, which is why the table above has one row.

The third-party executor Maka used to run, cua-driver, was removed along with
its vendored notice. Nothing in this tree spawns it or links against it.

`maka-cu` is itself a fork of MIT-licensed `iFurySt/open-codex-computer-use`
(§2), so when it does ship, that notice travels with it.

## 2. Licensed source read as reference

MIT-licensed source we read while designing. No code was copied into this
repository; what was taken is design — a format, a decision, or an archived
measurement. Attribution is given because it was load-bearing, not because MIT
compels it for ideas.

### iFurySt/open-codex-computer-use, and its fork QwenLM/open-computer-use

Both MIT, © 2026 Leo. An independent reimplementation of Codex's Computer Use
as an MCP server.

| Taken | Landed in | Notes |
|---|---|---|
| An archived capture of Codex's real `get_app_state` result | `packages/runtime/src/computer-use-tools.ts` | Their `open-codex-computer-use/artifacts/tool-comparisons/20260417-focus-behavior/`. This is what turned Maka's model of Codex's observation format from inference into an observed sample. |
| The one-line-per-element observation shape: indentation for containment, states written only when not the default | same file | Maka's version keeps `observation_id` in the header (frame binding is protocol here, prose there) and keeps element geometry (Codex has no coordinate action surface to need it; Maka's is disabled by default rather than absent). |
| Writing only the informative half of a state — `disabled`, never `enabled` | same file | Their `summarizeTraits`. |
| Filtering `AXPress` out of an element's advertised action list, because pressing is what `click` does | not yet landed — waits on `trycua/cua#2622` exposing per-element AX actions | Their `meaningfulActions`. |
| The permission-onboarding pattern: anchor a guidance panel to the System Settings window, track it, and distinguish grants that need an app relaunch | not yet landed — for the `feat/permission-onboarding` work | Their `open-codex-computer-use/apps/OpenComputerUse/Sources/OpenComputerUse/PermissionOnboardingApp.swift`. |
| Archiving side-by-side tool captures in-repo as evidence | practice, not code | Worth adopting for Maka's own Codex comparisons. |

Not taken, recorded so the decision is not re-litigated: their `SkyLightSPI` /
`SkyClickSimulation` synthetic-focus click. Their own comment states the recipe
is derived from cua-driver and yabai. Maka read the same recipe rather than
that code — which is why removing the cua-driver binary from this tree changes
nothing here: what was borrowed was a published recipe, not the artifact.

## 3. Observed, not licensed

Codex Computer Use (`SkyComputerUseService` and its helper bundles) is
proprietary and ships no source. Nothing was copied from it, because there is
nothing to copy: what exists here was reimplemented from observed behaviour and
from constants recovered by inspecting the shipped binary.

This confers no rights and is not a license. Statements about it are
descriptions of what a build did on a given date, and are dated for that reason.

| Recovered | Landed in |
|---|---|
| The agent cursor: shape, hotspot, motion thresholds, spring constants, and the candidate-path scoring function | `apps/desktop/src/renderer/computer-use-overlay/engine/cursor-engine.ts` |
| Overlay level policy — an occluded target raises the cursor rather than hiding it | same file, and `apps/desktop/src/main/computer-use/cursor-overlay-window.ts` |
| The observation text shape | `packages/runtime/src/computer-use-tools.ts`, corroborated by the archived capture in §2 |

Where Maka deliberately diverges, the divergence is stated at the point of
divergence rather than here, so it is read by whoever is changing that code.