feat(tools): add computer-use tool (§6.13)

[gnanirahulnutakki]

Summary

• Adds crates/computer-use (ardur-computer-use), Phase 1 of the §6.13 computer-use blueprint: a closed 10-action vocabulary (capture, click, double_click, right_click, middle_click, drag, scroll, type, key, wait), an in-substrate BlockedActionPolicy denylist (5 hard-blocked key combos + 6 dangerous-text patterns, adapted from Hermes's computer_use/tool.py:80-107) enforced regardless of cap-token or consent state, a cap-token-shaped ComputerUseCaveat (per-action-kind permitted set), a session-scoped ConsentBroker (grant/revoke/TTL), the computer.{session.started,consent.granted,consent.revoked,action.invoked,action.denied,screenshot.taken}.v1 receipt family with a DenialSource that distinguishes blocked-action/cap-token/consent refusals, and a ComputerUseTool (computer.use) gated by a custom computer_use capability. Gate order: denylist → caveat → consent.
• Phase 1 backend (LocalInputDriver) uses enigo (mouse/keyboard synthesis) + xcap (screen capture) over public macOS APIs. The blueprint's own MVP decision explicitly rejects the private SkyLight-SPI path Hermes uses (SLEventPostToPid, etc.), gating it behind a separate computer_use_skylight_spi cap-token caveat reserved for a future phase — so this PR isn't under-delivering relative to the blueprint's own stated MVP scope.
• Documented Phase 2 TODOs in lib.rs: set_value/list_apps/focus_app (need AXUIElement accessibility-tree access, which neither enigo nor xcap expose), the som/ax capture modes, AXIsProcessTrustedWithOptions/CGPreflightScreenCaptureAccess OS-permission preflight, a real interactive consent dialog UI (ConsentBroker ships the state machine only), and cap-token-to-caveat projection from a verified Biscuit block.
• Companion PR to feat(tools): add sandboxed code-execution tool (§6.7) #321 (§6.7 code-execution) — together they close the /goal directive's tool-surface domain (code-execution + browser/computer-use). Browser automation (§6.9/§6.10) already ships as crates/browser and is not touched here.

Test plan

• cargo build -p ardur-computer-use
• cargo test -p ardur-computer-use (33/33 passing — denylist/caveat/consent gate-order tests, action-parsing tests, and a wait dispatch test; deliberately no test exercises real click/type/screenshot execution, since that would require Accessibility/ScreenRecording permission granted to the CI runner)
• cargo fmt --check
• cargo clippy -p ardur-computer-use --all-targets -- -D warnings
• cargo check --workspace --all-features (no cross-crate breakage from the new enigo/xcap/image/hex dependencies)

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 851e5c24-ea4b-482e-85ce-36575c03b60d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/computer-use-6.13-2026-07-14

---

_{Comment @coderabbitai help to get the list of available commands.}