Computer use

Computer use lets an agent see the screen and use the mouse and keyboard in other apps, for example to test an app it built. It is off by default.

A separate helper

Pond.app never asks for Accessibility or Screen Recording. Those go to Pond Computer.app, a small helper inside the Pond bundle.

• It has no Dock icon and no menu bar.
• pond computer-mcp opens it through LaunchServices when an agent first calls a computer tool. It quits 2 minutes after its last client.
• It serves computer.sock to Pond's own signed pond binary only. Each request must name an agent that pond-ptyd says is live.
• It always uses your user's own Pond folder, looked up in the user database. It ignores HOME and POND_HOME there, so a launch with a changed environment cannot point it at another folder.
• It reads the sealed settings with a read-only store. If computer use cannot be verified as on, it is off.

The path of one action

1. Claude Code calls a tool on pond computer-mcp.
2. The proxy forwards it over computer.sock.
3. Pond Computer reads the facts it needs just before acting: the element, secure input, the window list.
4. A pure function, the safety guard, decides: allow, ask you, or refuse.
5. If allowed, the action runs. Events go to pond-ptyd, and Pond.app shows the driving face, the outline and the preview.

A refusal is always a fixed sentence. Text from the screen, such as a window title or a button label, never goes back to the agent in it. That text goes only into the sheet you see.

Apps and access

An agent must ask for each app. A sheet lists the apps and the reason. Return and Esc both mean Don't allow, and the grant buttons have no keyboard shortcut. Grants live in the helper's memory for the session only.

Some apps can never be granted: Pond itself, system authentication dialogs, the Privacy & Security settings, Keychain Access and password managers, banking and crypto apps, and terminals. Some key combinations are never posted: log out, lock screen and Force Quit.

Before a consequence

A click on a control labelled with a word such as send, buy, pay or delete stops and asks you. The panel shows a crop of the target. If you do not answer within 120 seconds, the answer is no. An agent cannot type into a secure field.

Many agents at once

Locks keep agents from colliding:

• App leases. An agent leases the app it acts on. Different apps run in parallel. Agents wanting the same app queue, for at most 60 seconds. At most 4 agents hold leases at once.
• The input lane. One action's event sequence runs alone, for milliseconds, so two agents' events never interleave.
• The foreground turn. A step that must bring a window to the front runs alone, and puts your app, window and pointer back afterwards.

Pond tries the least intrusive way first: act on the element through Accessibility, then send events to the target window in the background, and only then bring the window to the front for one step.

Stopping and taking over

• Esc stops every driving agent. The helper takes that key itself, so an agent cannot fake it. Control-Esc does the same for agents in the background.
• A click or key press from you pauses the agent for 3 seconds. Moving the mouse does not.
• The blob shows a driving face, and an outline in the agent's colour marks the display in use.

Screenshots

Pond keeps the last frame per agent in memory for the header preview and drops it when the burst ends. Pond's own windows are left out of every capture. Screenshots the agent takes go to Claude, and Claude Code keeps them in that session's history. The access sheet says so.