TST Desk tstdesk-v0.2.1

What changed

TD-4837

• install GitHub releases from the app (d9ba8e8)

TD-4852

• add GitHub device-flow sign-in and repo tools (064698a)

TD-4853

• add Microsoft sign-in for job email (34092f5)

TD-4854

• add Google sign-in for Gmail delivery (7b05e11)

Other

• Release 0.2.1: bump every component version (e2b38ff)

TST Desk tstdesk-v0.2.0

What changed

TD-609

• search fallback chain with Bing shipped second (485db62)

TD-708

• record classifier judgments and close the seam criteria (5b7a3d0)
• backfill an empty typesafe_base_url when the backend is picked (c577490)
• pick the TypeSafe key from stored credentials, not a magic name (e12eebd)
• count implicit openrouter use in API keys 'Used for' (d2531be)
• TypeSafe connector as an opt-in judgment backend + key uses in Settings (79c4782)
• review fixes — threshold wiring, payload redaction, Settings honesty (7fb9c92)
• let the settings pane scroll (grid minmax fix) (14d9be0)
• judgments toggles in Settings, set_judgments protocol message (023f3f7)
• provider-neutral judgment seam + CU judgment features (dev) (cc5b41f)

TD-711

• wire candidate selection into the browser loop as browser_pick (1b557aa)

TD-1303

• tick first tagged release; flatten Release assets (c00442f)

TD-1406

• leave cargo test --lib out of CI for now (7647ed7)
• pin spawn creation flags and CIM parent lookup (b02e6db)
• drop POSIX-only printenv and false from Windows-run tests (7a662db)
• match cmd.exe internals on the Windows allowlist (4c80919)
• drive the Windows tree-kill branch through a taskkill shim (e08b8b0)
• treat taskkill not-found as already gone, not a veto (6499984)
• record that taskkill walks the tree before TerminateProcess (f8b3298)
• walk the Windows process tree before TerminateProcess (f9c866c)
• verify Windows process-tree kill and live secure-desktop refuse (037576a)

TD-1720

• re-export rail rowTitle; keep session preset next to busy (f2f8e59)
• fix bound-turn narrowing for svelte-check (f8f67e3)
• show turn activity on rail dots (fedcaf5)

TD-1722

• Settings → API keys can set the host (7002c5f)

TD-1723

• settings pane scrolls; add a source without a key (b6a8726)

TD-1724

• send tool_choice auto when tools are present (e1bc5b7)

TD-1725

• do not collect mcp.cli into the sidecar (1c9cc26)
• packaged tstd serves the computer-use MCP (ba10b66)

TD-1726

• frozen CU child resets the onefile extract dir (c24d9b3)

TD-1727

• packaged Linux computer-use runs in-process (226c996)

TD-1728

• keep 32k computer-use inside the context window (d995bdc)

TD-1729

• send screenshots as vision parts, not 50k of text (ee74292)

TD-1730

• keep at most one image on a local VLM prompt (56a7e20)

TD-1902

• order chat text and tool folds by arrival (ec7b6c5)

TD-1903

• name the saved screenshot file in desktop_screenshot's text (4a28d21)
• count echoed reasoning in the estimate, not in calibration (b2dd055)
• speak OpenRouter's reasoning_details agent dialect (1369a19)

TD-2001

• refuse Linux CU on Wayland before any Xlib call (bd020f4)

TD-2103

• Memory pane may replace a file at the line cap (3531654)

TD-2302

• pin that crash paths never reach memory distill (c18b870)

TD-2805

• pin the capacity meter to instructions + memory + pins (71d21ee)

TD-3402

• default the real-display overlay on, matching the daemon (bb6c36a)

TD-3407

• test that the kill-switch closes the CU session tag (46973b4)

TD-3801

• pin Slack and ntfy webhook accounts in the keychain tests (cfde613)

TD-3803

• document parse_job; keep autonomy DoD and Wayland click honest (192ced8)
• parse_job fills a draft; save stays a second call (ceecdb5)

TD-3804

• wire production scheduler delivery to Slack and ntfy (fa53311)

TD-3808

• plain-English cadences, per-job time zone, readable job errors (0aaade8)

TD-3809

• fire a scheduled job now without moving its slot (7802582)

TD-3810

• edit a scheduled job without losing its receipt (d63a2ac)

TD-3811

• keep each job run and open its session (fbf5ed7)

TD-3812

• pin the preset and engine on a scheduled job (f8e9f24)

TD-3813

• skip a scheduled slot that is already hours late (2887768)

TD-3814

• retry a scheduled run that failed transiently (5e7ba53)

TD-3815

• park a scheduled run waiting for approval (73ecccd)

TD-3816

• add job templates and schedule this chat (1fb3fec)

TD-3817

• start the next job after one succeeds (183e5c8)

TD-3818

• skip a scheduled slot when a local calendar blocks that day (d06422b)

TD-3819

• a max-run stop names the limit on the cancelled state (f03a363)
• give scheduled runs a configurable time limit (12ce257)

TD-3820

• keep the SMTP password out of echoed AUTH tokens and parse errors (1ea7037)
• deliver scheduled job reports by email (4334833)

TD-3821

• render scheduled reports as newsletter HTML (e6cb7bd)

TD-4301

• run autonomy shell inside the rootless container (efc803e)

TD-4707

• pin Discord and Telegram keychain account names (769109e)

TD-4823

• keep tst-cu-mcp mypy --strict clean on overlay painters (6ad3de6)

TD-4824

• split Linux support into its own milestone (3839131)

TD-4827

• let the inspector and session rail resize freely (9ea177e)

TD-4828

• read the foreground window from the window server, hide the ring switch (aba16de)

TD-4829

• read QueuedUserMessage.display in the Grok loop (2c5c4dd)
• background computer use, Grok photos, session engine chrome (5a46386)

TD-4831

• fix review regressions and record remaining release blockers (ca78d79)

TD-4832

• backlog story + DECISIONS entry for the CU foreground return (6083b07)
• return TST Desk to the foreground when a CU turn stops (97939ff)

TD-4833

• investigate residual warnings and record follow-up plan (44c37ec)
• fix strict types and compiler warnings (0f16c5d)

TD-4834

• pyobjc in the frozen sidecar + frozen overlay re-exec (0b07df2)

TD-4835

• reap subprocesses and config files on cancel (fb483ed)
• cache keychain presence probes; invalidate on key mutations (d80bc50)

TD-4836

• the focus guard exempts system surfaces (fa8e8f1)

TD-4838

• refuse non-ASCII and empty API keys (9d971e8)
• make macOS keychain items readable by security (3b0806b)

TD-4839

• fit in-flight tool results to the tier window (56b993c)

TD-4840

• pick up a fixed or rotated API key without a restart (2a36f5d)

TD-4841

• stop revive from reinserting the audit session row (be0fe95)

TD-4842

• honour --data-dir for logs and stop on SIGTERM (6d25d17)

TD-4843

• bind daemon config and state to --data-dir (96bdd54)

TD-4844

• stop quit-distill from holding shutdown (e7eb920)

TD-4845

• leave Claude Code's global steering unread by default (9993833)

TD-4846

• close leaked test sockets and send api_key_rejected after a retry (983d65d)

TD-4847

• return the foreground window with each computer-use action (1234527)

TD-4848

• remove the port file on every clean shutdown (4c4fc90)

TD-4849

• wait for the daemon to exit on quit (9d19330)

TD-4850

• shut the daemon down gracefully on system quit (35786b9)

TD-4851

• exercise the Linux waitid path on every platform (b17fb71)
• keep a ready quit-distill and close dead transports (59fc81b)

TD-4901

• split Wayland capture and input; never drive XWayland (195b4fb)

TD-4904

• cut default CI to ubuntu; stop packaging on every main push (8e94e87)

TD-5001

• declare dirname and fileURLToPath in the node test shim (c1811cf)
• ship sideload APK 0.1.4 (3305463)
• find AppShell from the test file, not the working directory (59f7c11)
• let a wide window collapse the activity pane (30d5092)
• keep the shell below the status bar (8cf5ff7)
• open the shell at / so the router does not 404 (dfd6b70)
• keep the shell source test inside the ruff line limit (ac7d6d5)
• ship a sideload Android WebView shell (328d201)

TD-5002

• pause an interactive turn that stops making progress (63dce58)

TD-5003

• stop the turn without closing the session (cf43070)

TD-5004

• cap nested steering and skip the nested walk on the home folder (fc87f01)

TD-5005

• the phone keeps its EZER connection across launches and restarts (4beb06c)

TD-5006

• budget the workspace map from the brain tier's context window (7ce7fdd)

TD-5007

• count tool definitions and calibrate token estimates from provider usage (cf1a1ed)

TD-5008

• send max_tokens from the tier and add a per-tier extra_body (690e371)

TD-5009

• steer file changes to fs_edit/fs_write and nudge shell writes (44649e1)

TD-5010

• elide in-turn results to 70% of the budget once over it (78e3ef3)

TD-5011

• load Claude Code skills (name key, whenToUse fallback) (c7d7141)

TD-5012

• fix review findings on the verdict cap warning (cf8cf0f)
• let the worker's verdict calls turn the model's thinking off (0e161b1)

TD-5013

• fix review findings on calibration persistence and map sizing (59260f6)
• learned token ratios survive a restart and size the workspace map (e1d0c5f)

TD-5014

• use a test-range tailnet address in fixtures (0a543c7)
• satisfy the network and loopback guards (77d66f7)
• record the decision, document re-pair/self-removal/presence, steady a slow test (ae008a0)
• fix review findings (UI) (905290c)
• fix review findings in the daemon (fd3f888)
• fix review findings (Android) (d1524e9)
• regenerate protocol fixtures for the pairing messages (3d2c464)
• pair a phone with a one-time code (daemon side) (e0eb182)
• phone pairing in the UI (scan or type a code, Phones and devices) (19ae7eb)
• Android shell pairs by QR code or link and keeps its computer (4521661)

TD-5015

• declare add_machine as ClientMessage interfaces (2137f59)
• hub.finish reads the handshake's remote flag (c4325a5)
• fix review findings (dial host check, remote self-removal scrub, lane invariant, parked links, re-pair lanes, unreachable timing) (69a0e7f)
• fixtures, DECISIONS entry and docs (406a240)
• tst machines [add|remove] (c264adb)
• the daemon hub: paired computers, control links and lanes (19f6712)
• protocol, machine identity, peer kinds and bridged ids (eff21cf)
• fix review findings on remote-session UI (bf2bbdb)
• Settings > Computers, Copy link, and the phone's...

TST Desk 0.1.0

Unsigned first public build. v0.1 ships without code signing; first launch needs the per-platform click-through in the README (Installing an unsigned build) and docs/signing.md.

Download the artifact for your platform, check it against SHA256SUMS.txt, then install.

Platform	File
macOS (Apple silicon)	TST.Desk_0.1.0_aarch64.dmg
macOS (Intel)	TST.Desk_0.1.0_x64.dmg
Linux (x86_64)	TST.Desk_0.1.0_amd64.AppImage and TST.Desk_0.1.0_amd64.deb
Linux (ARM64)	TST.Desk_0.1.0_aarch64.AppImage and TST.Desk_0.1.0_arm64.deb
Windows	TST.Desk_0.1.0_x64_en-US.msi

These installers were produced by Package run 33147408105 at 4330c37 (Windows process-group kill). The tag tstdesk-v0.1.0 points at 451ac6f, which adds events.jsonl seq-order on persist. GitHub Actions spending-limit blocked a rebuild of that SHA (Release 33177767804 — empty jobs, runner_id: 0). Raise the org Actions budget and re-run Release to refresh installers from the tag.

What changed

TD-102

• tst-cua audit and reuse report (2118cff)

TD-103

• repository scaffold (3c120ef)

TD-104

• Python toolchain under core/ (f99b927)

TD-105

• Tauri and frontend toolchain (608b8b4)

TD-106

• CI pipeline (839ef45)

TD-107

• pre-commit hooks (04127c6)

TD-201

• daemon process skeleton (b9858b6)

TD-202

• local WebSocket server (bce2437)

TD-203

• connection handshake and local auth (adc606b)

TD-204

• protocol schema (f6106f0)

TD-208

• accept rule_activated in parse_daemon_event (7bc4d1a)

TD-301

• add keychain module and tests (48980e1)
• provider client, keychain, and tests (6c2ab2d)

TD-302

• model configuration schema (e68b9c1)

TD-303

• tier routing policy (e7c596a)
• tier routing policy (66ffa83)

TD-304

• cost and token accounting (87da0a8)

TD-305

• cache-aware prompt assembly (fdc64ba)
• track merge cleanup — jsonschema type stubs + merge decisions (e2d4a79)

TD-306

• resilience — retry with backoff, Retry-After, actionable errors, stream interruption (913e52d)

TD-307

• mock provider for offline, deterministic testing (be8a49f)

TD-401

• port agent loop core — plan→act→record with 3-tier routing (86d9bb7)

TD-402

• tool dispatch — ToolDispatcher, loop integration, mock sequences (029897d)

TD-403

• turn lifecycle events — event emission, typed status, ordering tests (02722a4)

TD-404

• cancellation — in-flight stream interruption, tool dispatch abort, tests (69930d1)

TD-405

• context window guard — compact older turns at user boundaries, ContextCompacted timeline event (d3b6e55)

TD-501

• steering file discovery and precedence (a600170)

TD-502

• CLAUDE.md fallback for steering discovery (525bbb6)

TD-503

• touch-tracking — dispatch records successful path targets on the session, loop assembles with matched_paths and announces RuleActivated once per rule, stack handler reports the true scoped verdict; UI renders activations as steering timeline entries (8641a52)
• path-scoped rules with frontmatter appliesTo (60a0f30)

TD-504

• import resolution for steering files (48c8c17)

TD-505

• import-approval follow-ups — tool_result pairs the synthetic approval id so cards clear, malformed config tolerated at load and save, doctor and stack panel forward the durable allowlist (2fd90d8)
• comment-only config toleration in approved-imports load/save (TD-1103 scaffold) (b6c46dd)
• external import approval — gate, approve/deny, persisted allowlist (83259d9)

TD-506

• token counting and instruction stack (88f35ad)

TD-507

• workspace manifest generation (0372d0f)

TD-508

• per-tier context routing (8f8f0c5)

TD-509

• hot reload (1a1ee09)

TD-510

• strip frontmatter at every steering level (d568ace)

TD-511

• anchor a bare-name appliesTo at the basename (93db2d6)

TD-601

• tool registry — Tool model, ToolRegistry, built-in tools (0d6773a)

TD-602

• path boundary enforcement — canonical, traversal, steering, Windows-unsafe (b93899f)

TD-603

• filesystem read tools — fs_read (numbered lines, binary/encoding refusal) + fs_list (glob, ignore-aware) (da1f2db)

TD-604

• filesystem write tools — fs_write/fs_edit, atomic writes, diffs (ba48f78)

TD-605

• daemon-restart integration test tolerates the OS kill veto — crash SIGKILL and clean-shutdown SIGTERM skip guarded on EPERM (never masking a body failure), cleanup kills suppress and leave the child to its --parent-pid watchdog (f98630a)
• parent-watchdog test tolerates the OS kill veto — skip on EPERM instead of failing; the vetoed round never exercises the product code (fdfc30f)
• kill honesty under OS veto — report EPERM refusals instead of claiming the group died; shield spawn against mid-spawn cancel; tests key veto tolerance on the product's report (3b5ff1b)
• shell execution — streaming output, group kill, sanitized env, allowlist (5c10689)

TD-606

• an empty allowed_commands means unrestricted (cb87c52)

TD-607

• return dispatch_many results in input order (a638774)

TD-610

• web_fetch pages; tell the model to fan out then compile (b03fc1e)

TD-701

• decision class model and static rule table (d8cc3a2)

TD-702

• decision classifier chokepoint on every tool dispatch (7468c74)

TD-703

• sync TypeScript protocol with classifier_cost (cbe281f)
• worker-tier classifier for ambiguous decisions (18aabfd)

TD-704

• decisions ledger — §12.3 markdown, atomic locked append, Class A requires commit, decision_logged event (41572ab)

TD-705

• checkpoint commits — session-branch snapshots via git plumbing (0a84b01)

TD-706

• workspace boundary configuration — .tst/config.yaml, defaults, validation, boundary_update event (e33205c)

TD-707

• cap enforcement — spend/wall-clock/iteration caps pause the session as a fault report, resume reloads the boundary (e548b9e)

TD-801

• policy model — (tool, argument pattern) → auto/ask/never (af69f92)

TD-802

• approval flow — park, approve/deny, timeout, resumable (dfb0820)

TD-803

• record Class B decisions — rule lifecycle via daemon API, (tool, args) identity (c975ee0)
• always-allow — narrow rule, proposal on card, list/revoke, Class C refused (52f5943)

TD-804

• add a real Skip all approvals setting (7431915)

TD-806

• skip-all is skip everything (1087b87)

TD-901

• append-only audit store in SQLite (41a5186)

TD-902

• audit writer — event-fed, non-blocking, loud on failure (f5f9827)

TD-903

• cost aggregation over the costs view + JSONL/CSV export (f322e13)

TD-1001

• application shell — window state, split pane, tokens, themes (51d8529)

TD-1002

• daemon supervision — host spawn/port-file connect, crash restart, clean shutdown, parent watchdog (cb14821)

TD-1003

• protocol client — typed WS client w/ reconnect+backoff, from_seq replay, connection-state banner, tolerant unknown events (d3e10d1)
• protocol client — typed WS client w/ reconnect+backoff, from_seq replay, connection-state banner, tolerant unknown events (ee2258e)

TD-1004

• chat pane — composer, streaming markdown, virtualized history, auto-scroll, cancel (b8ee844)

TD-1005

• activity timeline — virtualized daemon event stream, inline expansion, live shell output, diff/decision highlighting (ca48d68)

TD-1006

• title bar — workspace picker, tier chips, live cost meter, state + wall indicators; tier_state event, per-tier cost breakdown, set_tier dispatch (e73acdd)

TD-1007

• approval-store behavior tests — stream add/remove, reattach replay shapes, approve/deny/always-allow wire messages (c7e427f)
• record always-allow card decisions and tick AC #2 (25ca0dd)
• approval cards — approve/deny over client send(), error_code on tool_result, approval timeline kind with in-place resolve (ffd1a46)

TD-1008

• errors and notifications — typed turn failures on the wire, copy table, toast/banner store, copy diagnostics (752380d)

TD-1009

• scope the activity timeline to the bound session (897c64d)

TD-1010

• the client's event gate was dropping the usage panel's events (212b911)

TD-1011

• end a split-pane drag even when pointer capture is lost (bfad924)

TD-1012

• stop the message-list virtualizer from freezing the window (714ba94)

TD-1014

• bind-and-clear approval cards; dismiss on send (15484b7)

TD-1101

• first-run wizard — setup-state wire, keychain store+validate, preset persist, wizard UI (09783da)

TD-1102

• tick acceptance boxes — credential storage integrated (dc9af4d)
• credential storage — Windows Credential Manager backend via ctypes, delete_api_key verb acked by fresh setup_state (key_delete_failed typed error), wizard key step gains Remove stored key, all key-fix copy points at the title-bar gear (phantom tstd keychain CLI dropped), websockets frame logger capped at INFO under debug (raw frame dumps carried set_api_key payloads), end-to-end hygiene canary asserted absent from disk/logs/audit.db/wire (5ddc704)

TD-1103

• workspace management — refuse non-directory opens, scaffold commented .tst/config.yaml, recents menu with switch/remove (0b914c2)

TD-1104

• diagnostics — run_diagnostics wire, daemon checks (one shared key/provider probe, path-scrubbed rows), doctor pane with copyable redacted report (f2c58f3)

TD-1105

• bound hung keychain CLIs and keep tests off the host keyring (525edc0)
• tick acceptance boxes — keychain locked/drift surface integrated (03e9113)
• keychain locked/drift surface — stderr classified at the CLI boundary into KeychainLockedError, daemon maps it to keychain_locked, UI banner names the unlock + retry path (574a8ad)

TD-1106

• tick acceptance ...

tst-cu-mcp v0.2.0 - Windows support

tst-cu-mcp v0.2.0 — Windows support

A local computer-use MCP server: lets a model see the screen and drive the
desktop over stdio. One package, two backends, selected at runtime from
sys.platform.

Install

pip install tst_cu_mcp-0.2.0-py3-none-any.whl

A single py3-none-any wheel is correct for both platforms: the PyObjC
dependencies carry sys_platform == 'darwin' markers, so a Windows install
skips them and adds no runtime dependency at all (ctypes is stdlib; Pillow was
already required for the downscale path).

What's new

• Windows backend. DPI-aware capture and geometry, SendInput actuation,
  UIPI and secure-desktop reporting. Per-monitor-v2 awareness is set before any
  geometry is read, so a scaled display reports true pixels rather than scaled
  ones.
• win/super is pressable on its own. VK_LWIN needs the extended-key
  flag; without it the Start menu never opens. Found by live use, not review.
• expect_window on every input tool. Pass part of the intended window's
  title or process name and the action is refused, before anything is sent,
  unless that window is in front. A coordinate aims at a point, not at a thing.
• New tools: get_foreground_window, get_cursor_position, wait,
  wait_for_window.
• Reads are exempt from the kill-switch. Halting the hands should not blind
  the eyes: capture and state queries keep working while actuation is stopped.

Verification status

Verified on Windows 11 at 150% display scaling: 342 headless tests, 45 desktop
tests against the real OS, plus a live driving session covering capture, click,
type, scroll, the focus guard's refusal path, and the kill-switch.

The macOS half of this release is unverified. The darwin backend ships and
its pre-existing 0.1.0 functionality was working before the port, but the
cursor_position and foreground_window implementations added in 0.2.0 have
never been executed on a Mac. There is also no macOS desktop test tier. Treat
the darwin path as untested in this release.

Linux is not supported. get_backend() raises UnsupportedPlatformError
naming the supported platforms. Note the wheel will still install on Linux —
it is pure Python with no platform-gated dependencies — so the failure appears
at first tool call rather than at install time.

Known gaps

No drag (click is down-and-up at a single point), no screenshot frame hash for
cheap change-polling, and no element-level targeting. Coordinate-driven
automation is brittle by construction; the expect_window guard manages that
rather than removing it.