v1.9.0

Added

• Preview macOS development in a separate standard account, so agents can build and interact with
  GUI apps without interrupting your desktop. Guided setup is available from Application setup…
  or glass-mcp setup --account ACCOUNT, using the existing MCP tools and your normal workspace.
  A first manual login and environment startup after reboot are required; see the
  macOS setup guide.

• glass_capabilities adds a read-only scope: "session" report for click, scroll and text support,
  including whether admitted input can affect your desktop. It recognizes existing Linux/mobile
  isolation, explicit X11 display attachment, shared native macOS/Windows input and connected mobile
  driver limitations, using the same input tools and existing permissions.

• Experimental glass_a11y_snapshot_diff in the full tool profile returns fresh, lossless
  compact-outline revisions with full-read recovery, bounded retention and completeness disclosures.
  macOS attests unambiguous read scope; unqualified backends return full observations without retention.

Changed

• The opt-in macOS native diagnostics inspect live process/window ownership without requiring fixed test-app identities or unchanged executable files, arguments, cwd or environment. The developer build feature is now native-diagnostics; it remains read-only and does not provide headless input.
• macOS accessibility snapshots avoid duplicate value reads for checkboxes, radio buttons, and switches while preserving their reported values and checked states.
• Windows accessibility snapshots fetch properties in bulk while preserving node, depth, and sibling limits.

Fixed

• macOS clipboard support no longer mistakes runtime in a development application path or identifier for a hardened-runtime signing flag.
• macOS build output is captured in application logs instead of reaching the MCP transport; build failures return bounded compiler diagnostics as untrusted application output, separately from the error status.
• Starting a different backend now preserves the current session when its stop fails, so unresolved application cleanup cannot be silently discarded.
• Linux, macOS and Windows build commands now receive the env values passed to glass_start, matching Android and iOS and allowing requested compiler and dependency settings to apply to both build and launch.
• macOS contained launches inspect relative executable paths in the requested working directory, so eligible rebuilt apps retain clipboard support. Bare commands use the launch PATH rather than a same-named file in Glass's directory.
• macOS accessibility actions can recover a target whose tree position changed when one complete bounded search finds the same role and name at its original bounds. Ambiguous matches, unreadable searches and moved targets still refuse the action.
• macOS double and triple clicks now send the full sequence of paired mouse events, allowing Qt controls to recognize word selection correctly. Multi-click deadlines still release a pressed button before stopping.
• macOS typing now sends Unicode characters, including accented text, CJK and emoji, through keyboard events while preserving ASCII keys and keyboard chords.
• On Windows, glass doctor now warns when Sandboxie's global network prompt setting cannot be read or returns unexpected output, preserving the query failure details and providing a command to diagnose it.
• On Windows, glass_stop now reports a partial-stop error when a window adopted outside the launched process set remains open. Launch reports that ownership boundary, and stop leaves the external window and its process untouched.
• Windows doctor checks now distinguish WGC probe errors and panics from unsupported capture, preserve Windows error details, and retry failed probes on later calls.

Full changelog