Desktop Tools 0.14.0

Added

• The Desktop Tools app asks once per agent, such as Claude Code or a terminal app, "Allow name to control this Mac?", and refuses every request from an agent you haven't allowed with CALLER_NOT_APPROVED, listings and captures included, without making it wait. Agents are recognized by their validated signature, or by their path when unsigned, and Approved Agents in the menu revokes, allows or forgets each one. After updating, each agent you use is asked about once. Recent Activity names the agent, such as claude-code, instead of node. Embedding apps opt in with desktop_tools_set_caller_handler. (#120)
• desktop_fill_password fills the focused password field. It reads a Keychain item the agent names, by service or by server (an internet password fills only a web page on that server), so macOS asks you before Desktop Tools reads it and the agent never sees the password. It can also take text from the agent, which you approve fill by fill in a Desktop Tools prompt that names the agent, the app and the site, unless you turn on Always Allow Agent-Supplied Passwords in the menu (off by default). It is completed when the field shows the right number of characters. Results and Recent Activity never include the password or its length, and system password prompts, such as administrator authentication, are refused. Embedding apps ask the user through desktop_tools_set_confirmation_handlers and set the always-allow choice with desktop_tools_set_password_autofill. (#124)

Changed

• desktop_inspect keeps containers an agent can scope into, such as a Finder window's file list after its long sidebar, when its result is cut to size, dropping other elements first. (#126)
• Agent input aimed at any Desktop Tools process, including another build of it, or sent while one of its prompts or menus is open, is refused with SELF_TARGET_REFUSED, so only the user can answer its prompts or choose Pause All Input. Agents can still observe them. (#120)
• Behavior change: while a password field has keyboard focus, desktop_key refuses keys that type characters and Command-V, and desktop_insert refuses all its routes, and desktop_menu refuses Paste commands (found by their Command-V shortcut, whatever the title), with SECURE_FIELD_REQUIRES_FILL. Nothing is sent. Return, Tab, Escape, arrows, Delete and other shortcuts still work. Passwords go in only through desktop_fill_password and its approval. (#124)

Fixed

• desktop_click with modifiers, such as Command-click or Shift-click, no longer fails its cleanup every time with DESKTOP_ACTION_FAILED and "cursor restoration … could not be verified": the host read the pointer back before its restoring move had landed. It reports cursor_restoration again and stays unknown with DESKTOP_ACTION_UNVERIFIED, since a modifier click's effect can't be confirmed. (#128)
• desktop_clipboard_read with save_path saves images again; the host never enabled image export, so every such read was refused. The build now fails if the host would drop an operation the app allows. (#125)
• A clipboard paste whose receiver never took it, such as an image pasted into a TextEdit .rtf document, no longer blocks every clipboard write and paste until that app quits: closing the receiving window releases it too, and the refusal says so. (#125)
• window_appears no longer counts a window macOS keeps listed but ordered out on the current Space as open, so expect with window_appears for Spotlight works on macOS 27, where Siri AI (com.apple.campo) hosts the panel. (#125)
• Command-A in a text field is completed again instead of unknown with a receipt mismatch: the client checked the host's receipt for a layout-resolved key without the keyboard layout, which only the main thread can read. (#126)
• Finder windows with a long sidebar keep their focused file list in observations, so desktop_insert with format: "files" pastes into them instead of being refused for having no focused control. (#126)
• Renaming a file through Finder's Name column with desktop_set_cell, or its name field with desktop_type or desktop_set_value, used to report completed while Finder only showed the new name and never renamed the file. It is now refused before input with CELL_NOT_EDITABLE. (#126)
• A desktop_key sequence that stops partway reports KEY_SEQUENCE_STOPPED whatever stopped it, as when Command-N moves focus to a new window, instead of a bare DESKTOP_ACTION_FAILED, and says when the key that stopped it may have been sent. (#126)
• desktop_read with table: true no longer reports a role description such as "cell", "column" or "image" as cell text or a column title, or a folder's disclosure triangle as 0 in its Name cell, and names a sorted column by its title rather than its sort direction. (#126)