Desktop Hand 1.0.0

Desktop Hand 1.0.0 - first public release.

First public release. Desktop Hand gives a DeepSeek Harness model real desktop
mouse/keyboard control plus a policy-guarded file toolkit, with a "see ? act ?
see" loop built on screenshots and read_image.

Added

• 21 model-facing tools
  • Observation: desktop_hand_get_pointer, desktop_hand_foreground_window,
    desktop_hand_screenshot.
  • Real input: desktop_hand_move_mouse, desktop_hand_click,
    desktop_hand_drag, desktop_hand_scroll, desktop_hand_press_key,
    desktop_hand_type_text.
  • Guarded files: desktop_hand_read_file, desktop_hand_list_dir,
    desktop_hand_write_file, desktop_hand_move_path,
    desktop_hand_delete_path, desktop_hand_restore_path,
    desktop_hand_list_trash.
  • Control: desktop_hand_authorize, desktop_hand_revoke,
    desktop_hand_status, desktop_hand_policy_override,
    desktop_hand_emergency_stop.
• User-only /desktop-hand command for session grants, revocation, policy
  tightening, status, emergency stop and resume.
• Replaceable input provider layer: persistent Windows PowerShell agent
  (user32 SendInput/mouse events, Unicode text, DPI-aware, virtual-screen
  screenshots), Linux xdotool, macOS cliclick/osascript, and a
  deterministic fake provider for testing and dry runs.
• Filesystem policy engine: directory-prefix, glob and regex zones resolved
  against real paths (symlink/junction aware); separate read-only and
  write-protected zones; protected OS roots, plugin data, trash directory and
  workspace/home/drive roots.
• Three delete modes: forbid, trash (quarantine with metadata snapshot
  • restore) and direct (explicit unlock + confirm_direct + approval).
• Session-scoped, time- and action-bounded grants for input and files,
  granted only through the human command or an approval-gated tool.
• Approval gate on tools/pre-execute for file mutations, direct deletes,
  drags, key chords, sensitive-window text and security-posture changes.
• System-wide emergency stop (default Pause, configurable), which kills
  the input backend, blocks operations, notifies the model and requires a
  human /desktop-hand resume.
• Limits and sensitive zones: action/click/scroll/text/drag caps, virtual
  screen bounds checks, and taskbar/corner/system-area protection.
• Append-only JSONL audit log with coordinates, keys, paths, policy hits,
  timestamps and call ids; typed text is redacted unless explicitly enabled.
• Install/uninstall scripts for a DSH profile, with patch backup, idempotent
  managed block, seeded user config, and data-preserving uninstall.
• Documentation: English and Chinese READMEs, configuration reference and a
  manual acceptance guide (Blender modelling scenario, deletion modes,
  emergency stop, grant budgets).
• 167 automated tests covering configuration, policy, trash/audit,
  authorization/limits/emergency, providers and end-to-end tool integration.

Security notes

• Real input and file mutations are off by default.
• The filesystem policy governs Desktop Hand tools (optionally DSH's own
  read/write/edit tools via policy.enforceOnDshFsTools); it is not an OS
  sandbox. Shell tools have their own policies and can bypass it.
• Under a DSH approval policy of never, every ask category fails closed.
  Switch the session approval policy to ask or set the relevant
  approval.* categories to grant (relying on bounded session grants).

Asset: desktop-hand-1.0.0.zip (source snapshot, also available from the tag).

See README and ACCEPTANCE.

SHA-256 of desktop-hand-1.0.0.zip: a1cd61e1dd6456ca1d117f90c37993bdec3deeba2dd784680565d579813ef3c2